Cyber Security for Instant Messaging Across Platforms

ABSTRACT

A cyber threat defense system can incorporate data from an instant messaging platform with multiple other platforms in a client system to identify cyber threats across the client system. The system can have one or more instant messaging modules to collect instant messaging data from one or more network entities that utilizes one or more instant messaging platforms. A user specific profile module can identify a user of the client system associated with the user account based on a composite user profile constructed from user context data collected across multiple platforms of the client system. A risk profile module can associate the user with a user risk profile based on the composite user profile. The risk profile module can apply one or more artificial intelligence classifiers to the instant message based on the user risk profile. A cyber threat module is configured to identify whether the instant messaging data corresponds to a cyber threat partially based on the user risk profile. An autonomous response module can execute an autonomous response in response to the cyber threat factoring in the user risk profile.

NOTICE OF COPYRIGHT

A portion of this disclosure contains material that is subject tocopyright protection. The copyright owner has no objection to thefacsimile reproduction by anyone of the material subject to copyrightprotection as it appears in the United States Patent & TrademarkOffice's patent file or records, but otherwise reserves all copyrightrights whatsoever.

RELATED APPLICATION

This application claims priority to and the benefit of under 35 USC 119of U.S. provisional patent application titled “An Intelligent CyberSecurity System,” filed Sep. 14, 2020, Ser. No. 63/078,092, and claimspriority to and the benefit of under 35 USC 119 of U.S. provisionalpatent application titled “A Cyber Security System Using ArtificialIntelligence,” filed May 18, 2020, Ser. No. 63/026,446 which isincorporated herein by reference in its entirety.

FIELD

Embodiments of the design provided herein generally relate to a cyberthreat defense system. In an embodiment, a cyber threat defense systemmay incorporate data from an instant messaging platform.

BACKGROUND

In the cyber security environment, firewalls, endpoint security methodsand other tools such as security information and event managementsystems (SIEMs) and restricted environments, such as sandboxes, aredeployed to enforce specific policies and provide protection againstcertain threats. These tools currently form an important part of anorganization's cyber defense strategy, but they are insufficient in thenew age of cyber threat.

Cyber threat, including email threats, viruses, Trojan horses, andworms, can subtly and rapidly cause harm to a network. Additionally,human users may wreak further damage to the system by malicious action.A cyber security system has to identify each of these cyber threats asthey evolve.

SUMMARY

A cyber threat defense system can incorporate data from an instantmessaging platform with multiple other platforms in a client system toidentify cyber threats across the client system. The system can have oneor more instant messaging modules to collect instant messaging data fromone or more network entities that utilize one or more instant messagingplatforms. A user specific profile module can identify a user of theclient system associated with the user account based on a composite userprofile constructed from user context data collected across multipleplatforms of the client system. A risk profile module can associate theuser with a user risk profile based on the composite user profile. Therisk profile module can apply one or more artificial intelligenceclassifiers to the instant message based on the user risk profile. Acyber threat module is configured to identify whether the instantmessaging data corresponds to a cyber threat partially based on the userrisk profile. An autonomous response module can execute an autonomousresponse in response to the cyber threat factoring in the user riskprofile.

These and other features of the design provided herein can be betterunderstood with reference to the drawings, description, and claims, allof which form the disclosure of this patent application.

DRAWINGS

The drawings refer to some embodiments of the design provided herein inwhich:

FIG. 1 illustrates a block diagram of an embodiment of a cyber threatdefense system with a cyber threat module that referencesmachine-learning models that are trained on the normal behavior of anetwork entity to identify cyber threats by identifying deviations fromnormal behavior.

FIG. 2 illustrates a block diagram of an embodiment of an example chainof unusual behavior for a network entity activity in connection with therest of the network under analysis.

FIG. 3 illustrates an embodiment of an example cyber threat defensesystem protecting an example network.

FIG. 4 illustrates in a block diagram an embodiment of the integrationof the threat detection system with other network protections.

FIG. 5 illustrates a diagram of an example application of a cyber threatdefense system using advanced machine learning to detect anomalousbehavior.

FIG. 6 illustrates a flowchart of an embodiment of a method for modelinghuman, machine, or other activity.

FIG. 7 illustrates a flowchart of an embodiment of a method foridentifying a cyber threat based on a data model.

FIG. 8 illustrates a flowchart of an embodiment of a method forgathering data from across multiple platforms of the client system.

FIG. 9 illustrates a flowchart of an embodiment of a method foridentifying threats across multiple platforms of the client system.

FIG. 10 illustrates a block diagram of instant messaging data.

FIG. 11 illustrates a flowchart of an embodiment of a method forcollecting instant messages using a web hook.

FIG. 12 illustrates a flowchart of an embodiment of a method forcollecting instant messages by polling an application programminginterface.

FIG. 13 illustrates a flowchart of an embodiment of a method forcollecting instant messages using a mobile device management sub-module.

FIG. 14 illustrates a block diagram of an example range of artificialintelligence classifiers.

FIG. 15 illustrates a flowchart of an embodiment of a method forgenerating the artificial intelligence classifiers.

FIG. 16 illustrates an embodiment of a graphical user interface.

FIG. 17 illustrates a flowchart of an embodiment of a method forgenerating the graphical user interface.

FIG. 18 illustrates a flowchart of an embodiment of a method foridentifying an autonomous response.

FIG. 19 illustrates a block diagram of a threat risk parameter.

FIG. 20 illustrates a flowchart of an embodiment of a method forgenerating a threat risk parameter.

FIG. 21 illustrates a block diagram of a benchmark matrix.

FIG. 22 illustrates a flowchart of an embodiment of a method forgenerating a benchmark matrix.

FIG. 23 illustrates a flowchart of an embodiment of a method forcalculating a degree of damage score.

FIG. 24 illustrates a flowchart of an embodiment of a method forexecuting an autonomous response.

FIG. 25 illustrates in a block diagram user context data.

FIG. 26 illustrates a flowchart of an embodiment of a method forgenerating a composite user profile.

FIG. 27 illustrates a diagram of an example network to be protected bythe cyber threat defense system.

While the design is subject to various modifications, equivalents, andalternative forms, specific embodiments thereof have been shown by wayof example in the drawings and will now be described in detail. Itshould be understood that the design is not limited to the particularembodiments disclosed, but—on the contrary—the intention is to cover allmodifications, equivalents, and alternative forms using the specificembodiments.

DESCRIPTION

In the following description, numerous specific details are set forth,such as examples of specific data signals, named components, number ofservers in a system, etc., in order to provide a thorough understandingof the present design. It will be apparent, however, to one of ordinaryskill in the art that the present design can be practiced without thesespecific details. In other instances, well known components or methodshave not been described in detail but rather in a block diagram in orderto avoid unnecessarily obscuring the present design. Further, specificnumeric references such as a first server, can be made. However, thespecific numeric reference should not be interpreted as a literalsequential order but rather interpreted that the first server isdifferent than a second server. Thus, the specific details set forth aremerely exemplary. Also, the features implemented in one embodiment maybe implemented in another embodiment where logically possible. Thespecific details can be varied from and still be contemplated to bewithin the spirit and scope of the present design. The term coupled isdefined as meaning connected either directly to the component orindirectly to the component through another component.

In general, the cyber threat defense system may use artificialintelligence to analyze cyber security threats to a client system. Thecyber threat defense system can incorporate data from an instantmessaging platform hosted by a third-party to identify cyber threatsrelated to instant messaging. The cyber threat defense system cancollect data on one or more network entities (e.g. users, networkdevices, etc.) that utilize instant messaging. The cyber threat defensesystem uses one or more machine-learning models trained on a normalbenign behavior of each network entity that utilizes instant messaging.The cyber threat defense system identifies whether a breach state and achain of relevant behavioral parameters deviating from the normal benignbehavior of that network entity correspond to a cyber threat. The cyberthreat defense system executes one or more autonomous responses inresponse to the cyber threat using an autonomous response module.

FIG. 1 illustrates a block diagram of an embodiment of a cyber threatdefense system with a cyber threat module that references machinelearning models that are trained on the normal behavior of networkactivity and user activity associated with a network. The cyber threatmodule determines a threat risk parameter that factors in ‘what is alikelihood of a chain of one or more unusual behaviors of instantmessaging activity, email activity, Software-as-a-Service (SaaS)activity, network activity, and user activity under analysis that falloutside of being a normal benign behavior; and thus, are likelymalicious behavior.

The cyber threat defense system 100 may protect against cyber securitythreats from an instant messaging platform as well as its network. Thecyber threat defense system 100 may include components such as i) atrigger module, ii) a gather module, iii) a data store, iv) a probemodule, v) an Instant Messaging (IM) module, vi) a coordinator module,vii) a user specific profile module, viii) a risk profile module, ix) acomparison module, x) a cyber threat module, xi) a user interfacemodule, xii) an autonomous response module, xiii) at least one input oroutput (I/O) port to securely connect to other ports as required, xiv)one or more machine learning models such as multiple ArtificialIntelligence models trained on instant messages and other instantmessaging activity for each specific instant messaging platform, anArtificial Intelligence model trained on compliance protocols for theclient system in which a user operates, multiple Artificial Intelligencemodels trained on user context data from each specific instant messagingplatform, an Artificial Intelligence model trained on characteristics ofvectors for malicious activity and related data, an ArtificialIntelligence model trained on potential cyber threats, and one or moreArtificial Intelligence models each trained on different users, devices,system activities and interactions between entities in the system, andother aspects of the system to develop a normal pattern of life, as wellas xv) other similar components in the cyber threat defense system.

A trigger module may detect time stamped data indicating one or more i)events and/or ii) alerts from I) unusual or II) suspiciousbehavior/activity are occurring and then triggers that something unusualis happening. Accordingly, the gather module is triggered by specificevents and/or alerts of i) an abnormal behavior, ii) a suspiciousactivity, and iii) any combination of both. The inline data may begathered on the deployment from a data store when the traffic isobserved. The scope and wide variation of data available in thislocation results in good quality data for analysis. The collected datais passed to the comparison module and the cyber threat module.

The gather module may comprise of multiple automatic data gatherers thateach look at different aspects of the data depending on the particularhypothesis formed for the analyzed event and/or alert. The data relevantto each type of possible hypothesis will be automatically pulled fromadditional external and internal sources. Some data is pulled orretrieved by the gather module for each possible hypothesis. A feedbackloop of cooperation occurs between the gather module, the probe modulemonitoring network and email activity, the comparison module to applyone or more models trained on different aspects of this process, and thecyber threat module to identify cyber threats based on comparisons bythe comparison module. Each hypothesis of typical threats can havevarious supporting points of data and other metrics associated with thatpossible threat, such as a human user insider attack, inappropriatenetwork behavior, inappropriate instant messaging behavior,inappropriate email behavior, malicious software or malware attack,inappropriate network behavior, or inappropriate SaaS behavior. Amachine-learning algorithm will look at the relevant points of data tosupport or refute that particular hypothesis of what the suspiciousactivity or abnormal behavior related for each hypothesis on what thesuspicious activity or abnormal behavior relates to. Networks have awealth of data and metrics that may be collected. The gatherers may thenfilter or condense the mass of data down into the important or salientfeatures of data. In an embodiment, the probe module, the instantmessaging module, and the coordinator module may be portions of thecyber threat module.

A probe module can be configured to collect probe data from a probedeployed to a network entity. The network entity represents at least oneof a user device and a network device interacting with the network. Theprobe data describes any activity executed by the network entity andadministrated by a network administrator associated with the network.Such network-administrated activity would be external to any activity bya SaaS application executed by the network entity, which is hosted by athird-party platform. A network-administrated activity may be instantmessaging activity, email activity network activity, or SaaS activity.Note, the probe module may be divided into an instant messaging module,an email module, a network module, and a SaaS module.

A cyber threat defense system can incorporate data from an instantmessaging platform administrated by the client system or a third-partyoperator to identify cyber threats related to instant messaging. Thecyber threat defense module can have an instant messaging module tocollect instant messaging data from the instant messaging platform. Thecyber threat defense system can have a comparison module to compareinstant messaging data for a user to at least one machine-learning modelof a network entity using a normal behavior benchmark to spot behaviordeviating from normal benign behavior. The comparison module canidentify whether the user is in a breach state. The cyber threat defensesystem can have a cyber threat module to identify whether the breachstate and a chain of relevant behavioral parameters correspond to acyber threat. The cyber threat module can further apply one or moreartificial intelligence classifiers to the instant message based on theuser risk profile. An autonomous response module can execute anautonomous response in response to the cyber threat. The autonomousresponse module, rather than a human taking an action, can be configuredto cause one or more rapid autonomous actions to be taken to contain thecyber threat when the threat risk parameter from the cyber threat moduleis equal to or above an actionable threshold.

The cyber threat defense system can have one or more ports to connect toone or more probes monitoring multiple network devices that utilizeinstant messaging, email, network, or SaaS applications. One or moreinstant messaging modules can be configured to connect to one or moreinstant messaging connectors. Each instant messaging module can beconfigured to collect instant messaging data describing communicationson a given instant messaging platform. The instant messaging data mayinclude participants, text content, links, attachments, or apps. Theinstant messaging module can harvest from the instant messaging datathose participants, text content, attachments, hyperlinks, and apps. Inaddition to the instant messaging module, other probe modules can beconfigured to collect, from the one or more probes, probe datadescribing email activity, network activity, or SaaS applicationactivity executed by the user.

An instant messaging module can be configured to collect instantmessaging data, in conjunction with the probe module, from one or morenetwork entities that utilize one or more instant messaging platforms.The instant messaging data describes an instant message associated witha user for use in identifying a cyber threat. The instant messaging datacan be associated with a user account on at least a first instantmessaging platform. Examples of an instant messaging platform mayinclude Slack®, Microsoft Teams®, or iMessage®. A third-part operatormay administrate the instant messaging platform. The cyber threatdefense system can have a connector remotely installed on each networkentity that utilizes the instant messaging platform. The at least oneconnector can access the instant messaging data via an applicationprogramming interface (API) for the instant messaging platform, byaccessing a messaging archive provided to the client system by theinstant messaging platform, or by executing a mobile device managementsub-module. The instant messaging module can connect to the connectorvia at least one input port. The cyber threat defense system can have aninstant messaging module for each instant messaging platform used by theusers on the network.

The instant messaging module may use a variety of approaches to retrieveinstant messaging data from an instant messaging platform. In oneapproach, the instant messaging module can access a messaging archivealready provided to the client system by the instant messaging platform.Instant messaging platforms often provide these messaging archives tocorporate clients for legal or compliance purposes. The instantmessaging module can piggyback off this existing infrastructure. Theclient system can retrieve the messaging archive using a web hookprovided by the instant messaging platform. The instant messaging modulecan provide a client authorization to the web hook for the instantmessaging platform to indicate that the client allows the cyber threatdefense system to access the messaging archive. The instant messagingmodule can use a web hook for the instant messaging platform to gatherthe messaging archive for the client system on the instant messagingplatform. The instant messaging module can then access the messagingarchive to collect the instant messaging data for the user account.

In an alternate approach, the instant messaging module can poll theinstant messaging platform directly for the instant messaging data. Theinstant messaging module may set a polling period to specify a timeframe for the instant messaging data. The instant messaging module canpoll an application programming interface of the instant messagingplatform for the instant messaging data associated with the useraccount. The instant messaging module can translate the instantmessaging data into a universal format. The instant messaging module canthen harvest at least one of participants, text content, attachments,hyperlinks, and apps from the instant messaging data.

In a further approach, the instant messaging module can use a mobiledevice management sub-module. A mobile device management sub-modulemanages mobile devices used within the client system. The instantmessaging module can execute the mobile device management sub-module toidentify and extract the instant messaging data for the instantmessaging module. The mobile device management sub-module in the instantmessage module can gather a messaging archive form the instant messagingplatform.

The probe modules monitoring email activity, network activity, and SaaSactivity and the instant messaging module monitoring instant messagingplatforms may each feed their data to a coordinator module to correlatecausal links between these activities to supply this input into thecyber threat module. The coordinator module can be configured tocontextualize the instant messaging data from the one or more instantmessaging modules with the probe data from the one or more probe modulesto create a combined data set for analysis. The coordinator module canuse a composite user profile to connect communications from thedifferent instant messaging platforms with events from the one or moreprobe modules.

A user specific profile module can construct a composite user profile toidentify a user across multiple internal and third-party platforms. Theuser specific profile module can construct a composite user profiledescribing the user based on user context data collected from instantmessaging platforms, email platforms, information technology networks,cloud platforms, and SaaS platforms collected by context gatherers inthe gather module. The user specific profile module can associate thecomposite user profile with the instant messaging data. The userspecific profile module can match the user context data from collectedby the gather module from internal and external sources. The userspecific profile module can apply a fuzzy classifier to the user contextdata from the context gatherer to match with other user context data.The user specific profile module can generate a confidence score for amatch between the user context data from the context gatherer withseparate user context data from other context gatherers at other modulesassociated with other applications and platforms. The user specificprofile module can adjust the confidence score based on the instantmessaging data. The user specific profile module can be configured toidentify a user of a client system associated with the user accountbased on a composite user profile constructed from user context datacollected across multiple platforms of the client system. The compositeuser profile for the multiple platforms of the client system can factorin data from the instant messaging platform as well as at least one of aSaaS platform, a cloud platform, an information technology network, andan email platform associated with the user.

A risk profile module can associate the user with a user risk profilebased on the composite user profile. The risk profile module isconfigured to assign a user importance score to the user risk profile ofthe user based on the composite user profile to indicate a potentialsphere of influence of the user. The potential sphere of influencerefers to the number of services and resources that the user can affect.The risk profile module can assess the potential sphere of influence ofthe user based on at least one of administrative permissions, lateralmovement, action persistence, and file access. Lateral movement refersto the ability of a user to move across services. Action persistencerefers to the extent that an action by a user can allow that user toeither remain in an environment undetected or shift to a new compromisemethod to remain in the network when detected. For an example of actionpersistence, a bad actor, acting as the user, can create an inbox rulethat forwards all the user's emails to the bad actor in case the user'spassword is reset to kick the bad actor out of the user's inbox. In afurther example of action persistence, a bad actor can have the abilityto create new user accounts allowing them to login undetected.

The risk profile module can generate a vulnerability score by applying aset of one or more artificial intelligence classifiers to the instantmessaging data based on the user risk profile. The artificialintelligence classifiers can include a personal name classifier, apassword classifier, an account login activity classifier, a time seriesclassifier, a bad link analysis classifier, an attachment classifier,natural language processing, a sentiment analysis, a keyword trendanalysis classifier, a compliance classifier, and a general normalityclassifier. The risk profile module can execute a sentiment analysis oftext content of a first instant message to determine a tone of the textcontent. The risk profile module can execute a keyword trend analysis ofthe instant message to look for words of interest. The risk profilemodule can assess compliance of the instant message with client systemprotocols describing a policy set instated by the client system.

The risk profile module can factor the user importance score and thevulnerability score into the user risk profile to calculate a degree ofdamage. The risk profile module can adjust the normal behavior benchmarkbased on the user risk profile. The user specific profile module, therisk profile module, a comparison module and a cyber threat module maybe combined into a user risk module.

The cyber threat module may also use one or more machine-learning modelstrained on cyber threats in the network. The cyber threat module mayreference the models that are trained on the normal behavior of useractivity, instant messaging activity, email activity, network activity,and SaaS activity associated with the network. The cyber threat modulecan reference these various trained machine-learning models and datafrom the probe module, the instant messaging module, and the triggermodule. The cyber threat module can determine a threat risk parameterthat factors in how the chain of unusual behaviors correlate topotential cyber threats and ‘what is a likelihood of this chain of oneor more unusual behaviors of the network activity and user activityunder analysis that fall outside of being a normal benign behavior;’ andthus, is malicious behavior.

The one or more machine learning models can be self-learning modelsusing unsupervised learning and trained on a normal behavior ofdifferent aspects of the system, for example, device activity and useractivity associated with an instant messaging platform. Theself-learning models of normal behavior are regularly updated. Theself-learning model of normal behavior is updated when new input data isreceived that is deemed within the limits of normal behavior. A normalbehavior threshold is used by the model as a moving benchmark ofparameters that correspond to a normal pattern of life for the computingsystem. The normal behavior threshold is varied according to the updatedchanges in the computer system allowing the model to spot behavior onthe computing system that falls outside the parameters set by the movingbenchmark.

The comparison module can compare the analyzed metrics on the useractivity and network activity compared to their respective movingbenchmark of parameters that correspond to the normal pattern of lifefor the computing system used by the self-learning machine-learningmodels and the corresponding potential cyber threats.

The comparison module is configured to execute a comparison of theinstant messaging data to at least one machine-learning model to spotbehavior on the network deviating from a normal benign behavior of thatuser. The comparison module receives the combined data set from thecoordinator module. The at least one machine-learning model is trainedon a normal benign behavior of a user. The at least one machine uses anormal behavior benchmark describing parameters corresponding to anormal pattern of activity for that user. The comparison module can usethe comparison to identify whether the user is in a breach state of thenormal behavior benchmark.

The comparison module can be integrated with the cyber threat module.The cyber threat defense system 100 may also include one or moremachine-learning models trained on gaining an understanding of aplurality of characteristics on a transmission and related dataincluding classifying the properties of the transmission and its metadata. The cyber threat module can then determine, in accordance with theanalyzed metrics and the moving benchmark of what is considered normalbehavior, a cyber-threat risk parameter indicative of a likelihood of acyber-threat.

The cyber threat defense system 100 may also include one or more machinelearning models trained on gaining an understanding of a plurality ofcharacteristics on an instant message and related data includingclassifying the properties of the instant message and its meta data.

The cyber threat module can also reference the machine learning modelstrained on an instant message and related data to determine if aninstant message or a series of instant messages under analysis havepotentially malicious characteristics. The cyber threat module can alsofactor this instant message characteristics analysis into itsdetermination of the threat risk parameter. The cyber threat module cangenerate a set of incident data describing an anomalous instant messageassociated with a user of the client system. The cyber threat module canuse the incident data to determine whether the anomalous instant messageindicates a breach state representing a malicious incident orconfidential data exposure. To do this, the cyber threat module can usethe user interface and display module to present the incident data to auser analyst for review. Alternately, the cyber threat module canexecute an autonomous analyst to use machine learning to determinewhether the user has entered a breach state.

Alternately, the cyber threat module can execute an autonomous analystto use machine-learning to determine whether the network entity in thebreach state is a cyber threat. The cyber threat module is configured toidentify whether the breach state identified by the comparison moduleand a chain of relevant behavioral parameters deviating from the normalbenign behavior of that network entity correspond to a cyber threat. Thecyber threat module can identify whether the instant messaging dataunder analysis corresponds to a cyber threat partially based on the userrisk profile.

The cyber threat defense system 100 may use multiple machine learningmodels. Each machine learning model may be trained on specific aspectsof the normal pattern of life for the system such as devices, users,network traffic flow, outputs from one or more cyber security analysistools analyzing the system, and others. One or more machine learningmodels may also be trained on characteristics and aspects of all mannerof types of cyber threats. One or more machine learning models may alsobe trained by observing vectors for malicious activity, such as networkactivity, instant messages, or emails. The cyber threat defense systemcan also use a machine learning model to determine whether an instantmessage is in compliance with any client system protocols.

A user interface module can be configured to cooperate with the cyberthreat module to communicate a first compliance violation or a firstpotential cyber threat. The user interface module can be configured torepresent the instant message in a graphical user interface. Thegraphical user interface can represent the instant message as aconnection between two or more users on a topology map, text data in amessage log, or a data point in a time series graph.

The cyber threat defense system 100 can then take actions to counterdetected potential cyber threats. The autonomous response module, ratherthan a human taking an action, can be configured to cause one or morerapid autonomous actions to be taken to contain the cyber threat whenthe threat risk parameter from the cyber threat module is equal to orabove an actionable threshold. The cyber threat module's configuredcooperation with the autonomous response module, to cause one or moreautonomous actions to be taken to contain the cyber threat, improvescomputing devices in the email system by limiting an impact of the cyberthreat from consuming unauthorized CPU cycles, memory space, and powerconsumption in the computing devices via responding to the cyber threatwithout waiting for some human intervention.

The autonomous response module can interact with the instant messagingmodule and the cyber threat module to automatically respond to anyissues with a user on an instant messaging platform. The cyber threatmodule may analyze the instant messaging data from an instant messagingplatform to identify any cyber threats. The cyber threat module maygenerate a threat risk parameter listing a set of values describingaspects of a potential cyber threat. The autonomous response module isconfigured to compare the threat risk parameter to a benchmark matrixhaving a set of benchmark scores to determine an autonomous response.The autonomous response module is configured to identify at least oneautonomous response to take in response to the cyber threat based on thethreat risk parameter. A connector may query an instant messagingplatform to discover available responses to a cyber threat, such assuspension of user accounts or curtailing user privileges. The instantmessaging module may collect those responses from the connector toprovide to the autonomous response module. The autonomous responsemodule can execute an autonomous response in response to the cyberthreat factoring in the user risk profile.

The autonomous response module may tag a specific user to have a lowerthreshold for an autonomous response, depending on the circumstances ofthe cyber threat. For example, a chief financial officer can cause muchdamage to a company by divulging account numbers. If the cyber threatmodule identifies a cyber threat of a financial nature, the autonomousresponse module can lower a threshold for the autonomous response uponidentifying a tagged user associated with the cyber threat. Theautonomous response module can simultaneously employ a number ofdifferent clustering methods including matrix-based clustering, densitybased clustering, and hierarchical clustering techniques to identifywhich users to tag with which threat type.

The cyber threat defense system can decide based upon the cyber threatdetected that limiting access to or deleting a suspect instant messageis the most appropriate and least disruptive method to suppress theaction. The cyber threat defense system can go further and revokevarious permission levels for the user, log the user out of the useraccount, or disable the user account or device for a fixed period. Note,the cyber threat defense system is not limited to applying this methodjust on the specific instant messaging platform where the threat wasdetected. The user may be logged out or disabled on all distributedplatforms, such as cloud, email, network, or various SaaS applicationsdue to potentially malicious actions on the physical network. Theautonomous response module thus can log users out of their accounts,disable their accounts for a period of time, etc.

Further, the instant messaging module can be configured to analyzecontent contained within one or more instant messages in an instantmessaging platform. For example, the instant messaging module cananalyze text within the instant messages. A cyber threat module isconfigured to cooperate with the instant messaging module to analyze forany potential malicious behavior deviating from a first user's normalbehavior compared against an artificial intelligence model trained onmaintaining a pattern of life of the first user in the instant messagingsystem. The comparison can indicate a possible cyber threat hascompromised the instant messaging platform. The instant messaging modulecan analyze content contained within the one or more instant messages,including the text within the instant messages, for complianceviolations by the one or more instant messages compared to a policy setfor a client system that uses the instant messaging platform. Anautonomous response module can be configured to cooperate with anapplication programming interface of the instant messaging platform totake an autonomous action itself, rather than a human taking the action,to mitigate against the first compliance violation or the firstpotential cyber threat.

The cyber threat defense system 100 may be hosted on a device, on one ormore servers, or in its own cyber threat appliance platform.

FIG. 2 illustrates a block diagram of an embodiment of an example chainof unusual behavior for the network entity in connection with the restof the network under analysis.

The user interface can display a graph 200 of an example chain ofunusual behavior for a user on an instant message platform in connectionwith the rest of the network under analysis.

The cyber threat module cooperates with one or more machine learningmodels. The one or more machine learning models are trained andotherwise configured with mathematical algorithms to infer, for thecyber threat analysis, ‘what is possibly happening with the chain ofdistinct alerts and/or events, which came from the unusual pattern,’ andthen assign a threat risk associated with that distinct item of thechain of alerts and/or events forming the unusual pattern.

This is ‘a behavioral pattern analysis’ of what are the unusualbehaviors of the network entity, such as a network, a system, a device,a user, or an email, under analysis by the cyber threat module and themachine learning models. The cyber defense system uses unusual behaviordeviating from the normal behavior and then builds a chain of unusualbehavior and the causal links between the chain of unusual behavior todetect cyber threats. An example behavioral pattern analysis of what arethe unusual behaviors may be as follows. The unusual pattern may bedetermined by filtering out what activities, events, or alerts that fallwithin the window of what is the normal pattern of life for that networkentity under analysis. Then the pattern of the behavior of theactivities, events, or alerts that are left, after the filtering, can beanalyzed to determine whether that pattern is indicative of a behaviorof a malicious actor, such as a human, a program, an email, or otherthreat. The defense system can go back and pull in some of the filteredout normal activities to help support or refute a possible hypothesis ofwhether that pattern is indicative of a behavior of a malicious actor.An example behavioral pattern included in the chain is shown in thegraph over a time frame of, an example, 7 days. The defense systemdetects a chain of anomalous behavior of unusual data transfers threetimes, unusual characteristics in the interaction with an instantmessaging platform in the monitored system three times which seem tohave some causal link to the unusual data transfers. Likewise, twiceunusual credentials tried unusual behavior of trying to access tosensitive areas or malicious IP addresses and the user associated withthe unusual credentials trying unusual behavior has a causal link to atleast one of those three interactions with the instant messagingplatform with unusual characteristics. When the behavioral patternanalysis of any individual behavior or of the chain as a group isbelieved to be indicative of a malicious threat, then a score of howconfident the defense system is in this assessment of identifyingwhether the unusual pattern was caused by a malicious actor is created.Next, also assigned is a threat level parameter (e.g. score orprobability) indicative of what level of threat does this maliciousactor pose to the system. Lastly, the cyber threat defense system isconfigurable in its user interface of the defense system on what type ofautomatic response actions, if any, the defense system may take when fordifferent types of cyber threats that are equal to or above aconfigurable level of threat posed by this malicious actor.

The cyber threat module may chain the individual alerts and events thatform the unusual pattern into a distinct item for cyber threat analysisof that chain of distinct alerts or events. The cyber threat module mayreference the one or more machine learning models trained on instantmessaging platform threats to identify similar characteristics from theindividual alerts or events forming the distinct item made up of thechain of alerts or events forming the unusual pattern.

One or more machine learning models may also be trained oncharacteristics and aspects of all manner of types of cyber threats toanalyze the threat risk associated with the chain or cluster of alertsor events forming the unusual pattern. The machine learning technology,using advanced mathematics, can detect previously unidentified threats,without relying on prescribed rules, and automatically defend networks.

The models may perform by the threat detection through a probabilisticchange in normal behavior through the application of an unsupervisedBayesian mathematical model to detect behavioral change in computers andcomputer networks. The core threat detection system is termed the‘Bayesian probabilistic’. The Bayesian probabilistic approach candetermine periodicity in multiple time series data and identify changesacross single and multiple time series data for the purpose of anomalousbehavior detection. From the email and network raw sources of data, alarge number of metrics can be derived each producing time series datafor the given metric.

The detectors in the cyber threat module, including the probe module andinstant messaging module components, can be discrete mathematical modelsthat implement a specific mathematical method against different sets ofvariables with the target. Thus, each model is specifically targeted onthe pattern of life of alerts and/or events coming from, for example, i)that cyber security analysis tool, ii) analyzing various aspects of theinstant messaging platform interactions, iii) coming from specificdevices and/or users within a system, etc.

At its core, the cyber threat defense system mathematicallycharacterizes what constitutes ‘normal’ behavior based on the analysisof a large number/set of different measures of a device's networkbehavior. The cyber threat defense system can build a sophisticated‘pattern of life’—that understands what represents normality for everyperson, device, email activity, SaaS activity, and network activity inthe system being protected by the cyber threat defense system.

As discussed, each machine learning model may be trained on specificaspects of the normal pattern of life for the system such as devices,users, network traffic flow, outputs from one or more cyber securityanalysis tools analyzing the system, email contact associations for eachuser, email characteristics, instant messaging activity, and others. Theone or more machine learning models may use at least unsupervisedlearning algorithms to establish what is the normal pattern of life forthe system. The machine learning models can train on both i) thehistorical normal distribution of alerts and events for that system andii) a normal distribution of information from similar peer systems toestablish the normal pattern of life of the behavior of alerts or eventsfor that system. Another set of machine learning models train oncharacteristics of the instant messaging platform and the activities andbehavior of the instant messaging platform users to establish a normalbehavior for these.

The models can leverage at least two different approaches to detectinganomalies: such as comparing each system's behavior to its own historyand comparing that system to its peers' history or such as comparing aninstant messaging platform's normal operations to both characteristicsof the instant messaging platform and the activities and behavior of itsusers. This multiple source comparison allows the models to avoidlearning existing bad behavior as ‘a normal behavior’, becausecompromised entities, such as devices, users, components, emails willexhibit behavior different to their immediate peers.

In addition, the one or more machine learning models can use thecomparison of i) the normal pattern of life for that systemcorresponding to the historical normal distribution of alerts and eventsfor that system mapped out in the same multiple dimension space to ii)the current chain of individual alerts and events behavior underanalysis. This comparison can yield detection of the one or more unusualpatterns of behavior within the plotted individual alerts or events,which allows the detection of previously unidentified cyber threatscompared to finding cyber threats with merely predefined descriptiveobjects or signatures. Thus, increasingly intelligent malicious cyberthreats, picking and choosing when they take their actions in order togenerate low level alerts and events, will still be detected, eventhough they have not yet been identified by other methods of cyberanalysis. These intelligent malicious cyber threats can include malware,spyware, key loggers, malicious links in an email, malicious attachmentsin an email, and others as well as nefarious internal informationtechnology staff who know intimately how to not set off any high-levelalerts or events.

The plotting and comparison are a way to filter out what is normal forthat system and then be able to focus the analysis on what is abnormalor unusual for that system. Then for each hypothesis of what could behappening with the chain of unusual events or alerts, the gather modulemay gather additional metrics from the data store including the pool ofmetrics originally considered ‘normal behavior’ to support or refuteeach possible hypothesis of what could be happening with this chain ofunusual behavior under analysis.

Note, each of the individual alerts or events in a chain of alerts orevents that form the unusual pattern can indicate subtle abnormalbehavior. Thus, each alert or event can have a low threat riskassociated with that individual alert or event. However, when analyzedas a distinct chain or grouping of alerts or events behavior forming thechain of unusual pattern by the one or more machine learning models,that distinct chain of alerts or events can be determined to now have amuch higher threat risk than any of the individual and/or events in thechain.

In addition, modern cyber-attacks can be of such severity and speed thata human response cannot happen quickly enough. Thanks to theseself-learning advances, a machine may uncover these emerging threats anddeploy appropriate, real-time responses to fight back against the mostserious cyber threats.

The threat detection system can self-learn and detect normality in orderto spot true anomalies, allowing organizations of all sizes tounderstand the behavior of users and machines on their networks at bothan individual and group level. Monitoring behaviors, rather than usingpredefined descriptive objects and/or signatures, means that moreattacks can be spotted ahead of time and extremely subtle indicators ofwrongdoing can be detected. Unlike traditional legacy defenses, aspecific attack type or new malware does not have to have been seenfirst before it can be detected. A behavioral defense approachmathematically models both machine, instant messaging platform, andhuman activity behaviorally, at and after the point of compromise, inorder to predict and catch today's increasingly sophisticatedcyber-attack vectors. It is thus possible to computationally establishwhat is normal, in order to then detect what is abnormal. In addition,the machine learning constantly revisits assumptions about behavior,using probabilistic mathematics. The cyber threat defense system'sunsupervised machine learning methods do not require training data withpre-defined labels. Instead, unsupervised machine learning methods mayidentify key patterns and trends in the data, without the need for humaninput.

The user interface and output module may also project the individualalerts and/or events forming the chain of behavior onto the userinterface with at least three-dimensions of i) a horizontal axis of awindow of time, ii) a vertical axis of a scale indicative of the threatrisk assigned for each alert and/or event in the chain and a thirddimension of iii) a different color for the similar characteristicsshared among the individual alerts and events forming the distinct itemof the chain. The different color may be red, blue, yellow, or others.For gray scale, the user interface may use different shades of gray,black, and white with potentially different hashing patterns. Thesesimilarities of events or alerts in the chain may be, for example,alerts or events are coming from same device, same user credentials,same group, same source identifiers, same destination Internet Protocoladdresses, same types of data transfers, same type of unusual activity,same type of alerts, same rare connection being made, same type ofevents, or others, so that a human can visually see what spatially andcontent-wise is making up a particular chain rather than merely viewinga textual log of data. Note, once the human mind visually sees theprojected pattern and corresponding data, then the human can ultimatelydecide if a cyber threat is posed. Again, the at least three-dimensionalprojection helps a human synthesize this information more easily. Thevisualization onto the user interface allows a human to see data thatsupports or refutes why the cyber threat defense system thinks theseaggregated alerts or events could be potentially malicious. Also,instead of generating the simple binary outputs ‘malicious’ or ‘benign,’the cyber threat defense system's mathematical algorithms produceoutputs that indicate differing degrees of potential compromise.

Defense System FIG. 3 illustrates an example cyber threat defense systemprotecting an example network. The example network FIG. 3 illustrates anetwork of computer systems 50 using a threat detection system. Thesystem depicted by FIG. 3 is a simplified illustration, which isprovided for ease of explanation of the invention. The system 50comprises a first computer system 10 within a building, which uses thethreat detection system to detect and thereby attempt to prevent threatsto computing devices within its bounds. The first computer system 10comprises three computers 1, 2, 3, a local server 4, and amultifunctional device (MFD) 5 that provides printing, scanning andfacsimile functionalities to each of the computers 1, 2, 3. All of thedevices within the first computer system 10 are communicatively coupledvia a local area network (LAN) 6. Consequently, all the computers 1, 2,3 can access the local server 4 via the LAN 6 and use thefunctionalities of the MFD 5 via the LAN 6.

The LAN 6 of the first computer system 10 is connected to the Internet20, which in turn provides computers 1, 2, 3 with access to a multitudeof other computing devices including server 30 and second computersystem 40. Second computer system 40 also includes two computers 41, 42,connected by a second LAN 43.

In this exemplary embodiment of the invention, computer 1 on the firstcomputer system 10 has the threat detection system and therefore runsthe threat detection method for detecting threats to the first computersystem. As such, it comprises a processor arranged to run the steps ofthe process described herein, memory required to store informationrelated to the running of the process, as well as a network interfacefor collecting the required information. This method shall now bedescribed in detail with reference to FIG. 3.

The computer 1 builds and maintains a dynamic, ever-changing model ofthe ‘normal behavior’ of each user and machine within the system 10. Theapproach is based on Bayesian mathematics, and monitors allinteractions, events, and communications within the system 10—whichcomputer is talking to which, files that have been created, networksthat are being accessed.

For example, computer 2 is based in a company's San Francisco office andoperated by a marketing employee who regularly accesses the marketingnetwork. Computer 2 is active from about 8:30 AM until 6 PM and usuallycommunicates with machines in the company's U.K. office in secondcomputer system 40 between 9.30 AM and midday. The same employeevirtually never accesses the employee time sheets, very rarely connectsto the company's Atlanta network, and has no dealings in South-EastAsia. The threat detection system takes all the information that isavailable relating to this employee to establish a ‘pattern of life’ forthat person, which is dynamically updated as more information isgathered. The ‘normal’ model is used as a moving benchmark, allowing thesystem to spot behavior on a system that seems to fall outside of thisnormal pattern of life and to flag this behavior as anomalous, requiringfurther investigation.

The threat detection system is built to deal with the fact that today'sattackers are getting stealthier. An attacker may be ‘hiding’ in asystem to ensure that they avoid raising suspicion in an end user, suchas by slowing their machine down, using normal software protocol. Anyattack process thus stops or ‘backs off’ automatically if the mouse orkeyboard is used. However, yet more sophisticated attacks try theopposite, hiding in memory under the guise of a normal process andstealing CPU cycles only when the machine is active, to defeat arelatively simple policing process. These sophisticated attackers lookfor activity that is not directly associated with the user's input. Asan Advanced Persistent Threat (APT) attack typically has very longmission windows of weeks, months, or years, such processor cycles can bestolen so infrequently that they do not impact machine performance.However cloaked and sophisticated the attack is, the attack will alwaysleave a measurable delta, even if extremely slight, in typical machinebehavior, between pre and post compromise. This behavioral delta can beobserved and acted on with the form of Bayesian mathematical analysisused by the threat detection system installed on the computer 1.

FIG. 4 illustrates in a block diagram the integration of the threatdetection system with other network protections. A network generally hasa firewall 402 as a first line of defense. The firewall 402 analyzespacket headers on incoming network data packets to enforce networkpolicy. The firewall 402 may be integrated with an intrusion preventionsystem (IPS) to analyze the packet header and payload for whole events.Internally, an identity management module 404 controls the access forthe users of the network.

A network security module 406 can enforce practices and policies for thenetwork as determined by a network administrator. An encryption module408 can encrypt communications within the network, as well as encryptingand decrypting communications between network entities and outsideentities. An anti-virus or anti-malware module 410 may search packetsfor known viruses and malware. A patch management module 412 can ensurethat security applications within the network have applied the mostup-to-date patches. A centralized logging module 414 may trackcommunications both internal to and interactive with the network. Thethreat detection system can act as real time threat intelligence 416 forthe network. The real time threat intelligence may interact with theother defense components to protect the network.

The cyber defense self-learning platform uses machine-learningtechnology. The machine learning technology, using advanced mathematics,can detect previously unidentified threats, without rules, andautomatically defend networks. Note, today's attacks can be of suchseverity and speed that a human response cannot happen quickly enough.Thanks to these self-learning advances, it is now possible for a machineto uncover emerging threats and deploy appropriate, real-time responsesto fight back against the most serious cyber threats.

The cyber threat defense system builds a sophisticated ‘pattern oflife’—that understands what represents normality for every person,device, and network activity in the system being protected by the cyberthreat defense system.

The threat detection system may self-learn and detect normality in orderto spot true anomalies, allowing organizations of all sizes tounderstand the behavior of users and machines on their networks at bothan individual and group level. Monitoring behaviors, rather than usingpredefined descriptive objects and/or signatures, means that moreattacks can be spotted ahead of time and extremely subtle indicators ofwrongdoing can be detected. Unlike traditional legacy defenses, aspecific attack type or new malware does not have to have been seenfirst before it can be detected. A behavioral defense approachmathematically models both machine and human activity behaviorally, atand after the point of compromise, in order to predict and catch today'sincreasingly sophisticated cyber-attack vectors. The approach may thuscomputationally establish what is normal, in order to then detect whatis abnormal.

This intelligent system may make value judgments and carry out highervalue, more thoughtful tasks. Machine learning requires complexalgorithms to be devised and an overarching framework to interpret theresults produced. However, when applied correctly these approaches canfacilitate machines to make logical, probability-based decisions andundertake thoughtful tasks.

Advanced machine learning is at the forefront of the fight againstautomated and human-driven cyber-threats, overcoming the limitations ofrules and signature-based approaches. For example, the machine learninglearns what is normal within a network without depending upon knowledgeof previous attacks. The machine learning thrives on the scale,complexity, and diversity of modern businesses, where every device andperson is slightly different. The machine learning turns the innovationof attackers against them, so that any unusual activity is visible. Themachine learning constantly revisits assumptions about behavior, usingprobabilistic mathematics. The machine learning is always up to date andnot reliant on human input. Utilizing machine learning in cyber securitytechnology is difficult, but when correctly implemented it is extremelypowerful. The machine learning means that previously unidentifiedthreats can be detected, even when their manifestations fail to triggerany rule set or signature. Instead, machine learning allows the systemto analyze large sets of data and learn a ‘pattern of life’ for what itsees.

FIG. 5 illustrates an application of a cyber threat defense system usingadvanced machine learning to detect anomalous behavior. A normal patternof behavior 510 may describe a set of user or device behavior within athreshold level of occurrence, such as a 98% probability of occurrencebased on prior behavior. An anomalous activity 520 may describe a set ofuser or device behavior that is above the threshold level of occurrence.The cyber threat defense system can initiate an autonomous response 530to counteract the anomalous activity, leaving the normal behaviorunaffected.

Machine learning can approximate some human capabilities to machines.Machine learning can approximate thought by using past information andinsights to form judgments. Machine learning can act in real time sothat the system processes information as it goes. Machine learning canself-improve by constantly challenging and adapting the model's machinelearning understanding based on new information.

New unsupervised machine learning therefore allows computers torecognize evolving threats, without prior warning or supervision.

Unsupervised Machine Learning

Unsupervised learning works things out without pre-defined labels. Thisallows the system to handle the unexpected and embrace uncertainty. Thesystem does not always know the characteristics of the target of thesearch but can independently classify data and detect compellingpatterns.

The cyber threat defense system's unsupervised machine learning methodsdo not require training data with pre-defined labels. Instead,unsupervised machine learning methods can identify key patterns andtrends in the data, without the need for human input. Unsupervisedlearning provides the advantage of allowing computers to go beyond whattheir programmers already know and discover previously unknownrelationships.

The cyber threat defense system uses unique implementations ofunsupervised machine learning algorithms to analyze network data atscale, intelligently handle the unexpected, and embrace uncertainty.Instead of relying on knowledge of past threats to be able to know whatto look for, the cyber threat defense system may independently classifydata and detect compelling patterns that define what may be consideredto be normal behavior. Any new behaviors that deviate from this notionof ‘normality’ may indicate threat or compromise. The impact of thecyber threat defense system's unsupervised machine learning on cybersecurity is transformative. Threats from within, which would otherwisego undetected, can be spotted, highlighted, contextually prioritized,and isolated using these algorithms. The application of machine learninghas the potential to provide total network visibility and far greaterdetection levels, ensuring that networks have an internal defensemechanism. Machine learning has the capability to learn when to executeautomatic responses against the most serious cyber threats, disruptingin progress attacks before they become a crisis for the organization.

This new mathematics not only identifies meaningful relationships withindata, but also quantifies the uncertainty associated with suchinference. By knowing and understanding this uncertainty, it becomespossible to bring together many results within a consistentframework—the basis of Bayesian probabilistic analysis. The mathematicsbehind machine learning is extremely complex and difficult to get right.Robust, dependable algorithms are developed, with a scalability thatenables their successful application to real-world environments.

Overview

In an embodiment, the cyber threat defense system's probabilisticapproach to cyber security is based on a Bayesian framework. This allowsthe cyber threat defense system to integrate a huge number of weakindicators of potentially anomalous network behavior to produce a singleclear measure of how likely a network device is to be compromised. Thisprobabilistic mathematical approach provides an ability to understandimportant information amid the noise of the network, even when thetarget of a search is unknown.

Ranking Threats

Crucially, the cyber threat defense system's approach accounts for theinevitable ambiguities that exist in data, distinguishing between thesubtly differing levels of evidence that different pieces of data maycontain. Instead of generating the simple binary outputs ‘malicious’ or‘benign,’ the cyber threat defense system's mathematical algorithmsproduce outputs that indicate differing degrees of potential compromise.This output enables users of the system to rank different alerts in arigorous manner, prioritizing those that most urgently require actionand simultaneously removing the problem of numerous false positivesassociated with a rule-based approach.

On a core level, the cyber threat defense system mathematicallycharacterizes what constitutes ‘normal’ behavior based on the analysisof a large number of different measures of network behavior by a device.Such network behavior may include server access, data access, timings ofevents, credential use, domain name server (DNS) requests, and othersimilar parameters. Each measure of network behavior is then monitoredin real time to detect anomalous behaviors.

Clustering

To be able to properly model what should be considered as normal for adevice, the behavior of the device must be analyzed in the context ofother similar devices on the network. To accomplish this, the cyberthreat defense system leverages the power of unsupervised learning toalgorithmically identify naturally occurring groupings of devices, atask which is impossible to do manually on even modestly sized networks.

In order to achieve as holistic a view of the relationships within thenetwork as possible, the cyber threat defense system simultaneouslyemploys a number of different clustering methods including matrix-basedclustering, density based clustering, and hierarchical clusteringtechniques. The resulting clusters are then used to inform the modelingof the normative behaviors of individual devices. Clustering analyzesbehavior in the context of other similar devices on the network.Clustering algorithms identify naturally occurring groupings of devices,which is impossible to do manually. Further, the cyber threat defensesystem may simultaneously run multiple different clustering methods toinform the models.

Network Topology

Any cyber threat detection system must also recognize that a network isfar more than the sum of its individual parts, with much of its meaningcontained in the relationships among its different entities. Plus, anycyber threat defense system must further recognize that complex threatscan often induce subtle changes in this network structure. To capturesuch threats, the cyber threat defense system employs several differentmathematical methods in order to be able to model multiple facets of anetwork topology.

One approach is based on iterative matrix methods that reveal importantconnectivity structures within the network. In tandem with these, thecyber threat defense system has developed innovative applications ofmodels from the field of statistical physics, which allow the modelingof a network's ‘energy landscape’ to reveal anomalous substructures thatmay be concealed within.

Network Structure

A further important challenge in modeling the behaviors of networkdevices, as well as of networks themselves, is the high-dimensionalstructure of the problem with the existence of a huge number ofpotential predictor variables. Observing packet traffic and hostactivity within an enterprise local area network (LAN), wide areanetwork (WAN) and Cloud is difficult because both input and output cancontain many interrelated features, such as protocols, source anddestination machines, log changes, rule triggers, and others. Learning asparse and consistent structured predictive function is crucial to avoidover fitting.

In this context, the cyber threat defense system has employed a cuttingedge large-scale computational approach to learn sparse structure inmodels of network behavior and connectivity based on applyingL1-regularization techniques, such as a Least Absolute Shrinkage andSelection Operator (LASSO) method. This allows for the discovery of trueassociations between different network components and events that can becast as efficiently solvable convex optimization problems and yieldparsimonious models.

Recursive Bayesian Estimation

To combine these multiple analyses of different measures of networkbehavior to generate a single comprehensive picture of the state of eachdevice, the cyber threat defense system takes advantage of the power ofRecursive Bayesian Estimation (RBE) via an implementation of the Bayesfilter.

Using RBE, the cyber threat defense system's mathematical models canconstantly adapt themselves, in a computationally efficient manner, asnew information becomes available to the system. They continuallyrecalculate threat levels in the light of new evidence, identifyingchanging attack behaviors where conventional signature-based methodsfail.

The cyber threat defense system's innovative approach to cyber securityhas pioneered the use of Bayesian methods for tracking changing devicebehaviors and computer network structures. The core of the cyber threatdefense system's mathematical modeling is the determination of normativebehavior, enabled by a sophisticated software platform that allows forits mathematical models to be applied to new network data in real time.The result is a system that can identify subtle variations in machineevents within a computer networks behavioral history that may indicatecyber-threat or compromise.

The cyber threat defense system uses mathematical analysis and machinelearning to detect potential threats, allowing the system to stay aheadof evolving risks. The cyber threat defense system approach means thatdetection no longer depends on an archive of previous attacks. Instead,attacks can be spotted against the background understanding of whatrepresents normality within a network. No pre-definitions are needed,which allows for the best possible insight and defense against today'sthreats. On top of the detection capability, the cyber threat defensesystem can create digital antibodies automatically, as an immediateresponse to the most threatening cyber breaches. The cyber threatdefense system approach both detects and defends against cyber threat.Genuine unsupervised machine learning eliminates the dependence onsignature-based approaches to cyber security, which are not working. Thecyber threat defense system's technology can become a vital tool forsecurity teams attempting to understand the scale of their network,observe levels of activity, and detect areas of potential weakness.These no longer need to be manually sought out, but rather are flaggedby the automated system and ranked in terms of their significance.

Machine learning technology is the fundamental ally in the defense ofsystems from the hackers and insider threats of today, and informulating response to unknown methods of cyber-attack. It is amomentous step change in cyber security. Defense must start within.

An Example Method

The threat detection system shall now be described in further detailwith reference to a flow of the process carried out by the threatdetection system for automatic detection of cyber threats throughprobabilistic change in normal behavior through the application of anunsupervised Bayesian mathematical model to detect behavioral change incomputers and computer networks.

The core threat detection system is termed the ‘Bayesian probabilistic’.The Bayesian probabilistic is a Bayesian system of automaticallydetermining periodicity in multiple time series data and identifyingchanges across single and multiple time series data for the purpose ofanomalous behavior detection.

FIG. 6 illustrates a flowchart of an embodiment of a method for modelinghuman, machine or other activity. The cyber threat defense systeminitially ingests data from multiple sources (Block 602). The raw datasources include, but are not limited to raw network Internet Protocol(IP) traffic captured from an IP or other network Test Access Points(TAP) or Switched Port Analyzer (SPAN) port; machine generated logfiles; connectors and sensors specifically designed for SaaSapplications, building access (“swipe card”) systems; IP or non-IP dataflowing over an Industrial Control System (ICS) distributed network;individual machine, peripheral or component power usage;telecommunication signal strength; or machine level performance datataken from on-host sources, such as central processing unit (CPU) usage,memory usage, disk usage, disk free space, network usage, and others.

The cyber threat defense system derives second order metrics from thatraw data (Block 604). From these raw sources of data, multiple metricscan be derived, each producing time series data for the given metric.The data are bucketed into individual time slices. For example, thenumber observed could be counted per 1 second, per 10 seconds or per 60seconds. These buckets can be combined at a later stage where requiredto provide longer range values for any multiple of the chosen internalsize. For example, if the underlying time slice chosen is 60 secondslong, and thus each metric time series stores a single value for themetric every 60 seconds, then any new time series data of a fixedmultiple of 60 seconds (such as 120 seconds, 180 seconds, 600 secondsetc.) can be computed with no loss of accuracy. Metrics are chosendirectly and fed to the Bayesian probabilistic by a lower order modelwhich reflects some unique underlying part of the data, and which can bederived from the raw data with particular domain knowledge. The metricsthat are obtained depends on the threats that the system is looking for.In order to provide a secure system, the cyber threat defense systemcommonly obtains multiple metrics relating to a wide range of potentialthreats. Communications from components in the network contacting knownsuspect domains.

The actual specific metrics used are largely irrelevant to the Bayesianprobabilistic system, as long as a metric is selected. Metrics derivedfrom network traffic could include data such as the number of bytes ofdata entering or leaving a networked device per time interval, fileaccess, the commonality or rarity of a communications process, aninvalid secure-sockets layer (SSL) certification, a failed authorizationattempt, or email access patterns.

In the case where transmission control protocol (TCP), user datagramprotocol (UDP), or other Transport Layer IP protocols are used over theIP network, and in cases where alternative Internet Layer protocols areused, such as Internet Control Message Protocol (ICMP) or Internet GroupMessage Protocol (IGMP), knowledge of the structure of the protocol inuse and basic packet header analysis can be utilized to generate furthermetrics. Such further metrics may include the number of multicasts pertime interval originating from a networked device and intended to reachpublicly addressable IP ranges, the number of internal link-local IPBroadcast requests originating from a networked device, the size of thepacket payload data, or the number of individual TCP connections made bya device, or data transferred by a device, either as a combined totalacross all destinations or to any definable target network range, suchas a single target machine or a specific network range.

In the case of IP traffic where the Application Layer protocol can bedetermined and analyzed, further types of time series metric can bedefined. These time series metrics may include, for example, the numberof DNS requests a networked device generates per time interval, againeither to any definable target network range or in total; the number ofSimple Mail Transfer Protocol (SMTP), Post Office Protocol (POP) orInternet Message Access Protocol (IMAP) logins or login failures amachine generates per time interval; the number of Lightweight DirectoryAccess Protocol (LDAP) logins or login failures generated; datatransferred via file sharing protocols such as Server Message Block(SMB), SMB2, File Transfer Protocol (FTP), or others; or logins toMicrosoft Windows Active Directory, Secure Shell (SSH) or Local Loginsto Linux or Unix-like systems, or other authenticated systems such asKerberos.

The raw data required to obtain these metrics may be collected via apassive fiber or copper connection to the networks internal switch gear,from virtual switching implementations, cloud-based systems, orcommunicating devices themselves. Ideally, the system receives a copy ofevery communications packet to provide full coverage of an organization.

For other sources, a number of domain specific time series data arederived, each chosen to reflect a distinct and identifiable facet of theunderlying source of the data, which in some way reflects the usage orbehavior of that system over time.

Many of these time series data sets are extremely sparse, with most datapoints equal to 0. Examples would be employee's using swipe cards toaccess a building or part of a building, or user's logging into theirworkstation, authenticated by Microsoft Windows Active Directory Server,which is typically performed a small number of times per day. Other timeseries data sets are much more populated, such as, the size of datamoving to or from an always-on Web Server, the Web Servers CPUutilization, or the power usage of a photocopier.

Regardless of the type of data, such time series data sets, whetheroriginally produced as the result of explicit human behavior or anautomated computer or other system to exhibit periodicity, have thetendency for various patterns within the data to recur at approximatelyregular intervals. Furthermore, such data may have many distinct butindependent regular time periods apparent within the time series.

Detectors carry out analysis of the second order metrics (Block 606).Detectors are discrete mathematical models that implement a specificmathematical method against different sets of variables with the targetnetwork. For example, Hidden Markov Models (HMM) may look specificallyat the size and transmission time of packets between nodes. Thedetectors are provided in a hierarchy that is a loosely arranged pyramidof models. Each detector model effectively acts as a filter and passesits output to another model higher up the pyramid. At the top of thepyramid is the Bayesian probabilistic that is the ultimate threatdecision making model. Lower order detectors each monitor differentglobal attributes or ‘features’ of the underlying network and orcomputers. These attributes may be value over time for all internalcomputational features such as packet velocity and morphology, endpointfile system values, and TCP/IP protocol timing and events. Each detectoris specialized to record and make decisions on different environmentalfactors based on the detectors own internal mathematical model such asan HMM.

While the threat detection system may be arranged to look for anypossible threat, in practice the system may keep watch for one or morespecific threats depending on the network in which the threat detectionsystem is being used. For example, the threat detection system providesa way for known features of the network such as desired compliance andHuman Resource policies to be encapsulated in explicitly definedheuristics or detectors that can trigger when in concert with set ormoving thresholds of probability abnormality coming from the probabilitydetermination output. The heuristics are constructed using complexchains of weighted logical expressions manifested as regular expressionswith atomic objects that are derived at run time from the output of datameasuring/tokenizing detectors and local contextual information. Thesechains of logical expression are then stored in online libraries andparsed in real-time against output from the measures/tokenizingdetectors. An example policy could take the form of “alert me if anyemployee subject to HR disciplinary circumstances (contextualinformation) is accessing sensitive information (heuristic definition)in a manner that is anomalous when compared to previous behavior(Bayesian probabilistic output)”. In other words, different arrays ofpyramids of detectors are provided for detecting particular types ofthreats.

The analysis performed by the detectors on the second order metrics thenoutputs data in a form suitable for use with the model of normalbehavior. As will be seen, the data is in a form suitable for comparingwith the model of normal behavior and for updating the model of normalbehavior.

The threat detection system computes a threat risk parameter indicativeof a likelihood of there being a threat using automated adaptiveperiodicity detection mapped onto observed behavioral pattern-of-lifeanalysis (Block 608). This deduces that a threat over time exists from acollected set of attributes that themselves have shown deviation fromnormative collective or individual behavior. The automated adaptiveperiodicity detection uses the period of time the Bayesian probabilistichas computed to be most relevant within the observed network ormachines. Furthermore, the pattern of life analysis identifies how ahuman or machine behaves over time, such as when they typically startand stop work. Since these models are continually adapting themselvesautomatically, they are inherently harder to defeat than known systems.The threat risk parameter is a probability of there being a threat incertain arrangements. Alternatively, the threat risk parameter is avalue representative of there being a threat, which is compared againstone or more thresholds indicative of the likelihood of a threat.

In practice, the step of computing the threat involves comparing currentdata collected in relation to the user with the model of normal behaviorof the user and system being analyzed. The current data collectedrelates to a period in time, this could be in relation to a certaininflux of new data or a specified period of time from a number ofseconds to a number of days. In some arrangements, the system isarranged to predict the expected behavior of the system. The expectedbehavior is then compared with actual behavior in order to determinewhether there is a threat.

The system uses machine learning or Artificial Intelligence tounderstand what is normal inside a company's network, and whensomething's not normal. The system then invokes automatic responses todisrupt the cyber-attack until the human team can catch up. This couldinclude interrupting connections, preventing the sending of maliciousemails, preventing file access, preventing communications outside of theorganization, etc. The approach begins in as surgical and directed wayas possible to interrupt the attack without affecting the normalbehavior of, for example, a laptop. If the attack escalates, the cyberthreat defense system may ultimately quarantine a device to preventwider harm to an organization.

In order to improve the accuracy of the system, a check can be carriedout in order to compare current behavior of a user with associatedusers, such as users within a single office. For example, if there is anunexpectedly low level of activity from a user, this may not be due tounusual activity from the user, but rather a factor affecting the officeas a whole. Various other factors can be considered in order to assesswhether abnormal behavior is actually indicative of a threat.

Finally, the cyber threat defense system determines, based on the threatrisk parameter, as to whether further action need be taken regarding thethreat (Block 610). A human operator may make this determination afterbeing presented with a probability of there being a threat. Alternately,an algorithm may make the determination, such as by comparing thedetermined probability with a threshold.

In one arrangement, given the unique global input of the Bayesianprobabilistic, a form of threat visualization is provided in which theuser can view the threat landscape across all internal traffic and do sowithout needing to know how their internal network is structured orpopulated and in such a way as a ‘universal’ representation is presentedin a single pane no matter how large the network. A topology of thenetwork under scrutiny is projected automatically as a graph based ondevice communication relationships via an interactive 3D user interface.The projection can scale linearly to any node scale without priorseeding or skeletal definition.

The threat detection system that has been discussed above thereforeimplements a propriety form of recursive Bayesian estimation to maintaina distribution over the probability state variable. This distribution isbuilt from the complex set of low-level host, network, and trafficobservations or ‘features’. These features are recorded iteratively andprocessed in real time on the platform. A plausible representation ofthe relational information among entities in dynamic systems in general,such as an enterprise network, a living cell or a social community, orindeed the entire internet, is a stochastic network, which istopological rewiring and semantically evolving over time. In manyhigh-dimensional structured input/output problems, such as theobservation of packet traffic and host activity within a distributeddigital enterprise, where both input and output can contain tens ofthousands to millions of interrelated features (data transport,host-web-client dialogue, log change and rule trigger, etc.), learning asparse and consistent structured predictive function is challenged by alack of normal distribution. To overcome this, the threat detectionsystem comprises a data structure that decides on a rolling continuumrather than a stepwise method in which recurring time cycles, such asthe working day, shift patterns, and other routines are dynamicallyassigned, thus providing a non-frequentist architecture for inferringand testing causal links between explanatory variables, observations andfeature sets. This permits an efficiently solvable convex optimizationproblem and yield parsimonious models. In such an arrangement, thethreat detection processing may be triggered by the input of new data.Alternatively, the threat detection processing may be triggered by theabsence of expected data. In some arrangements, the processing may betriggered by the presence of a particular actionable event.

The method and system are arranged to be performed by one or moreprocessing components with any portions of software stored in anexecutable format on a computer readable medium. The computer readablemedium may be non-transitory and does not include radio or other carrierwaves. The computer readable medium could be, for example, a physicalcomputer readable medium such as semiconductor or solid-state memory,magnetic tape, a removable computer diskette, a random-access memory(RAM), a read-only memory (ROM), a rigid magnetic disc, and an opticaldisk, such as a CD-ROM, CD-RAN or DVD.

The various methods described above may be implemented by a computerprogram product. The computer program product may include computer codearranged to instruct a computer to perform the functions of one or moreof the various methods described above. The computer program and/or thecode for performing such methods may be provided to an apparatus, suchas a computer, on a computer readable medium or computer programproduct. For the computer program product, a transitory computerreadable medium may include radio or other carrier waves.

An apparatus such as a computer may be configured in accordance withsuch code to perform one or more processes in accordance with thevarious methods discussed herein.

Integrating Third Party Instant Messaging Platforms

A cyber security appliance with cybersecurity monitoring can beconfigured to monitor and protect an instant messaging service orplatform. A service that ingests instant message data from one or moreexternal instant messaging services (e.g. WhatsApp, Facebook Messenger,etc.) can model a pattern of life for a user which takes into accountlogin activity, regular contacts, messaging times, and messagingcomposition, such as links or images. The cyber threat defense systemcan analyze message composition for suspicious links, potentiallymalicious app or file usage, potential data loss or compliance issues(use of unapproved file sharing, etc.) by one or more machine learningalgorithms. The cyber threat defense system can derive anomalousness ofmessaging times via machine learning analysis. The cyber threat defensesystem can apply sentiment detection—focused on users who interact withthose external to the organization—to detect inappropriatecommunications. The cyber threat defense system can model patterns ofcommunication between internal entities (departments, groups, teams) todetect potential compliance issues or a compromised account. The cyberthreat defense system can then perform autonomous actions including userlogouts, message deletion or permission revocation.

Using the cyber threat module, the cyber threat defense system learnsthe normal “pattern of life” of all communications-network-connectedelements of an on-premises and remote digital ecosystem, or clientsystem. Further, the cyber threat defense system can use an instantmessaging module to learn the interactions of the user on an instantmessaging platform. For example, the instant messaging module can detectwho a user contacts on the instant messaging platform, what text wassent, any files that are attached, and other actions. Once “normalbehavior” has been learned, the cyber threat defense system is capableof identifying unexpected or unusual behaviors from devices, software,or operators of devices.

Such unusual behavior might be a result of misconfiguration, accidentaluse, malicious use by a legitimate operator, or malicious use by athird-party. The instant messaging immune system has no priorassumptions and is capable of learning about the behavior of any deviceor person in on-premises environments, remote environments, and eventhird-party environments. The cyber threat defense system uses manydifferent machine learning and artificial intelligence techniques thatcompete to learn the best possible pattern of life for individualdevices or people, as well as subsets of their behavior.

The cyber threat defense system can learn the similarities of behaviorin groups of people and devices. The cyber threat defense system cancluster these groups to develop a baseline of “normal behavior” acrossthe group. The cyber threat defense system can then recognize when aperson or device is in the cluster is deviating from this “normalbehavior”.

The cyber threat defense system recognizes associated chains ofbehaviors. For example, an attack begins by subverting a publicrelations officer's laptop in a corporate environment. The attackspreads via instant messaging to computer systems in the procurementdivision. The procurement division is able to access customerinformation. The attack begins to manipulate the customer informationwith the potential for deliberate harm. All stages of this attack can beidentified by the cyber threat defense system and presented together incontext to a security professional at both the home network andoperating the instant messaging platform.

The cyber threat defense system can present its summarized findings andenable further human investigation into the unusual behavior todetermine whether this behavior represents an actual attack of even adamaging user error. The cyber threat defense system can autonomouslyrespond to the unusual behavior, if an attack is indicated, in anautomatic way that prevents the attack from progressing further. Forexample, the autonomous response module of the cyber threat defensesystem can restrict access to an instant message to prevent automaticviewing.

In an embodiment, the cyber threat defense system is configured tooperate across the entirety of the client system. For example, the cyberthreat defense system can incorporate the oversight of an instantmessaging platform with email platforms, networks, and SaaS platforms.

FIG. 7 illustrates a flowchart of an embodiment of a method foridentifying an anomalous event from data from across multipleproprietary or third-party platforms. The cyber threat defense systemcan use one or more probe modules configured to collect probe data fromone or more probes monitoring multiple network devices used by a useroperating in the client system (Block 702). The probe data can describeactivity on a variety of platforms, such as instant messaging platforms,email platforms, the client network, and any associated SaaS platforms.Specifically, the cyber threat defense system can use an instantmessaging module configured to collect instant messaging data associatedwith the user from an instant messaging platform (Block 704).

The cyber threat defense system uses a coordinator module tocontextualize the instant messaging data from the instant messagingmodule with the probe data from the probe module to create a combineddata set for analysis (Block 706). The cyber threat defense system usesa cyber threat module configured to analyze the combined data set usingat least one machine-learning model to spot behavior on the networkdeviating from the normal benign behavior (Block 708). The at least onemachine-learning model trains on a normal benign behavior of the user.The at least one machine-learning model uses a normal behavior benchmarkas a benchmark of at least one parameter corresponding to a normalpattern of activity for the network to spot deviant behavior.

The cyber threat defense system has a comparison module that comparesthe combined data set, including the instant messaging data, to the atleast one machine-learning model to spot behavior on the networkdeviating from a normal benign behavior of that user (Block 710). Thecomparison module can identify whether the user is in a breach state ofthe normal behavior benchmark (Block 712). The cyber threat module canidentify whether the breach state and a chain of relevant behavioralparameters deviating from the normal benign behavior of that usercorrespond to a cyber threat (Block 714).

The cyber threat defense system can use an autonomous response moduleconfigured to select an autonomous response to take in response to thecyber threat (Block 716). The autonomous response module can send analert of the cyber threat with a suggested response to the cyber threatto an internal system administrator or the third-party platform (Block718). The autonomous response module can execute the autonomous responsein response to the cyber threat (Block 720).

FIG. 8 illustrates a flowchart of an embodiment of a method forgathering user context data from across multiple platforms of the clientsystem. The cyber threat defense system may use a number of probemodules, each assigned to a different aspect of the client system. Theone or more probe modules may work with a gather module to collect usercontext data. One or more instant messaging modules may collect usercontext data via a connector with an instant messaging platform of theclient system (Block 802). A SaaS probe module may collect user contextdata via a connector with a SaaS platform of the client system (Block804). A cloud probe module may collect user context data via a connectorwith a cloud platform of the client system (Block 806). A network probemodule may collect user context data from an information technologynetwork of the client system (Block 808). An email probe module maycollect user context data via a connector with an email platform of theclient system (Block 810). The cyber threat defense system uses acoordinator module to contextualize the various user context data tocreate a combined data set for analysis (Block 812).

FIG. 9 illustrates a flowchart of an embodiment of a method for usinginstant messaging data to identify threats across multiple platforms ofthe client system. FIG. illustrates a flowchart of an embodiment of amethod for identifying threats across multiple third-party platforms. Acyber threat defense system can have one or more instant messagingmodules configured to register transmission of an instant message on aninstant messaging platform to or from a user account associated with theclient system (Block 902). Alternately, the instant messaging modulescan set a collection period. At the tolling of a collection period, theinstant messaging modules can execute a bulk collection of the instantmessaging data associated with the user that occurred during thecollection period. The one or more instant messaging modules can collectfrom one or more network entities that utilize one or more instantmessaging platforms instant messaging data describing the instantmessage and associated with the user account on at least a first instantmessaging platform (Block 904). The cyber threat defense system can havea user specific profile module configured to identify a user of theclient system associated with the user account based on a composite userprofile constructed from user context data collected across multipleinternal and external platforms of the client system in order tocontextualize the instant messaging data under analysis with data fromthe multiple platforms of the client system (Block 906). The compositeuser profile for the multiple platforms of the client system factors indata from the instant messaging platform, as well as a SaaS platform, acloud platform, an information technology network, and an email platformassociated with the user. The cyber threat defense system can have arisk profile module configured to associate the user with a user riskprofile based on the composite user profile (Block 908).

The cyber threat defense system can have a cyber threat moduleconfigured to applying one or more artificial intelligence classifiersto the instant message based on the user risk profile (Block 910). Thecyber threat defense system can have a comparison module configured tocompare the instant messaging data to one or more machine-learningmodels trained on a normal benign behavior of that network entity usinga normal behavior benchmark describing parameters corresponding to anormal pattern of activity for that network entity to spot behavior onthe network deviating from the normal benign behavior (Block 912). Thecyber threat defense system has a cyber threat module to identifywhether the third-party event data is in a breach state of the normalbehavior benchmark based on the comparison (Block 914). The comparisonmodule can also compare the combined data set created by the coordinatormodule, to at least one machine-learning model trained on a normalbenign behavior of that network entity using a normal behavior benchmarkdescribing parameters corresponding to a normal pattern of activity forthat network entity to spot behavior on the network deviating from thenormal benign behavior to identify whether the network entity is in abreach state of the normal benchmark. The cyber threat module canidentify whether a breach state corresponds to a cyber threat based onthe user risk profile. The cyber threat module configured to identifywhether the instant messaging data under analysis corresponds to a cyberthreat partially based on the user risk profile, the artificialintelligence classifiers, and the comparison (Block 916).

The cyber threat defense system can have a user interface moduleconfigured to represent the instant message as at least one of text dataand a data point in a time series in a graphical user interface (Block918). The cyber threat defense system can have an autonomous responsemodule configured to identify an autonomous response to the cyber threatfactoring in the user risk profile (Block 920). The autonomous responsemodule can execute an autonomous response in response to the cyberthreat using the autonomous response module factoring in the user riskprofile (Block 922).

FIG. 10 illustrates a block diagram of instant messaging data. Theinstant messaging data may describe the participants 1002 for theinstant message. The participants 1002 include the user sending themessage and any recipient receiving the message. The instant messagingdata may describe the text 1004 of the instant message. The text 1004may be written by the sender or autogenerated. The instant messagingdata may describe any hyperlinks 1006 included in the instant message.The instant messaging data may describe any attachments 1008 includedwith the instant message. The attachments 1008 may be files, such aspictures, videos, audio files, or documents. The instant messaging datamay describe any apps 1010 operating through the instant message. Theapps 1010 may be a file attached to the instant message or a botgenerating the instant message.

Collecting Instant Messaging Data

The cyber threat defense system can take various approaches tocollecting instant messaging data. FIG. 11 illustrates a flowchart of anembodiment of a method for collecting instant messaging data using theexisting messaging archive. The cyber threat defense system can have aninstant messaging module configured to provide a client authorization toa web hook for the instant messaging platform (Block 1102). The instantmessaging module can gather a messaging archive for the client systemusing a web hook for the instant messaging platform (Block 1104). Theinstant messaging module can set a collection window indicating theperiod from which to gather instant messaging data (Block 1106). Theinstant messaging module can access the messaging archive to collect theinstant messaging data for the user account (Block 1108). The instantmessaging module can apply one or more artificial intelligenceclassifiers to the instant message based on the user risk profile (Block1110).

FIG. 12 illustrates a flowchart of an embodiment of a method forcollecting instant messages by polling an application programminginterface. The cyber threat defense system can have an instant messagingmodule configured to set a polling period to specify a time frame forthe instant messaging data to be collected (Block 1202). The instantmessaging module can poll an application programming interface of theinstant messaging platform for the one or more messages associated withthe user account (Block 1204). The instant messaging module can receiveinstant messaging data from the instant messaging platform (Block 1206).The instant messaging module can translate the instant messaging datainto a universal format (Block 1208). The instant messaging module canharvest the text content from the instant messaging data (Block 1210).The instant messaging module can harvest the metadata from the instantmessaging data (Block 1212). The instant messaging module can apply oneor more artificial intelligence classifiers to the instant message basedon the user risk profile (Block 1214).

FIG. 13 illustrates a flowchart of an embodiment of a method forcollecting instant messages using a mobile device management sub-module.The cyber threat defense system can have an instant messaging moduleconfigured to execute a mobile device management sub-module to manageinstant messages in the client system (Block 1302). The instantmessaging module can direct a mobile device management sub-module in theprobe module to gather a messaging archive from the instant messagingplatform (Block 1304). The instant messaging module can access themessaging archive to collect the instant messaging data for the useraccount (Block 1306). The instant messaging module can apply one or moreartificial intelligence classifiers to the instant message based on theuser risk profile (Block 1308).

AI Classifiers

The risk profile module can apply one or more artificial intelligenceclassifiers to an instant message, indicating one or more troublesomeaspects about the instant message. FIG. 14 illustrates a block diagramof a range of artificial intelligence classifiers. The artificialintelligence classifier can highlight the personal name 1402 of theuser. The personal name 1402 can be used to connect the instant messageto other aspects of the user present in other realms of the clientsystem, such as the network activity, email habits, or SaaS usage. Theartificial intelligence classifier can highlight the password 1404 ofthe user. While the actual password 1404 may be kept hidden by the user,information such as password strength may be recorded. The artificialintelligence classifier can indicate the account login activity 1406 ofthe user. The account login activity 1406 warn of anomalous loginactivity, such as login attempts when the user would nominally beasleep.

The artificial intelligence classifier can indicate the position of theinstant message within a time series of communications 1408. A cyberthreat analysis can use this data to contextualize the message moreaccurately. The artificial intelligence classifier can warn of a badlink analysis 1410 in the instant message. The bad link analysis 1410warns of a hyperlink leading to a disreputable website. The artificialintelligence classifier can indicate an attachment 1412 is coupled tothe message. The attachment indication 1412 can include a generalassessment of the trustworthiness of the attachment.

The cyber threat module may make multiple assessments regarding the textof the instant message. The artificial intelligence classifier candescribe the results of natural language processing 1418 on the text.Natural language processing can be used to interpret the meaning of thetext. The artificial intelligence classifier can provide the results ofa sentiment analysis 1416 of the text. The sentiment analysis 1416 canindicate the general tone of the instant message based on machinelearning model as applied to the text.

The artificial intelligence classifier can describe the results of akeyword trend analysis 1418 of the instant message. The keyword trendanalysis 1418 looks for words that are flagged as being of interestbased on data collected from other instant messages as well as any emailplatforms, the network, or any SaaS platforms. The artificialintelligence classifier can flag whether the instant message is withincompliance with the client system protocols. The compliance flag 1420indicates whether the instant message violates any rules specific tothat client system. The artificial intelligence classifier can be ageneral normality classifier 1422. The general normality classifier 1422covers any odd characteristics not covered by other classifiers.

FIG. 15 illustrates a flowchart of an embodiment of a method forapplying the artificial intelligence classifiers. The cyber threatdefense system can have a risk profile module that receives instantmessaging data from an instant messaging module (Block 1502). The riskprofile module can receive the user identity from a user specificprofile module (Block 1504). The risk profile module can determine thepassword strength of the user account from the instant messaging data(Block 1506). The risk profile module can flag the login time of theuser to the user account from the instant messaging data (Block 1508).The risk profile module can determine the position the instant messagewithin a time series of messages based on metadata in the instantmessaging data (Block 1510).

The risk profile module can harvest the text from the instant messagingdata (Block 1512). The risk profile module can identify any hyperlinksor attachments in the instant messaging data (Block 1514). The riskprofile module can assess any hyperlinks or attachments in the instantmessaging data (Block 1516). The risk profile module can execute naturallanguage processing of the text of the instant message (Block 1518). Therisk profile module can execute sentiment analysis of the text of theinstant message to determine tone (Block 1520). The risk profile modulecan execute a keyword trend analysis of the instant message to look forwords of interest (Block 1522). The risk profile module can assesscompliance with client system protocols describing a policy set instatedby the client system (Block 1524). The risk profile module can assessthe general normality of the instant message (Block 1526).

Graphical User Interface

FIG. 16 illustrates a block diagram of a graphical user interface 1600.The graphical user interface 1600 may have a topology map 1610displaying a two-dimensional or three-dimensional representation of theinstant messaging platform. The topology map 1610 can have one or moreuser nodes 1612 acting as a visual avatar for a user on the instantmessaging platform. The topology map 1610 can illustrate each connectionbetween a user node 1612 and any other user node 1612 in contact withthat user node 1612. A user node 1612 can be marked to indicate an issuewith the represented network entity. The user analyst can select a usernode 1612 with the cursor to reveal more information about therepresented network entity.

Upon the selection of a user via selection of the network node 1612, thegraphical user interface can display a message log 1620 for that user.The message log 1620 may list a text line 1622 describing the messagetext for each instant message. The graphical user interface 1600 canflag a text line 1622 to indicate a hazard to the client system. Thegraphical user interface can use the message log to generate a timeseries graph 1630 to show the amount of activity over time. The useranalyst can identify problem users by identifying spikes in the timeseries graph 1630.

FIG. 17 illustrates a flowchart of an embodiment of a method forgenerating the graphical user interface. The cyber threat defense systemcan have a user interface module configured to generate a graphical userinterface (Block 1702). The user interface module can represent the useras a user node in a topology map (Block 1704). The user interface modulecan represent the instant message as a text line in a message logdescribing the text content of the instant message (Block 1706). Theuser interface module can represent the instant message as a data pointin a time series graph describing the flow of instant messages to andfrom a user (Block 1708). The user interface module can display thegraphical user interface to an administrator of the cyber threat defensesystem (Block 1710).

Autonomous Response

The autonomous response module can use threat risk parameter generatedby the cyber threat module to autonomously determine a response. FIG. 18illustrates a flowchart of an embodiment of a method for identifying anautonomous response. The cyber threat defense system can have the cyberthreat module configured to generate a threat risk parameter listing aset of values describing aspects of the cyber threat (Block 1802). Thecyber threat defense system can have the autonomous response moduleconfigured to generate a benchmark matrix having a set of benchmarkscores (Block 1804). The autonomous response module can identify atagged user associated with the cyber threat (Block 1806). Theautonomous response module can lower a threshold for the autonomousresponse upon identifying a tagged user associated with the cyber threat(Block 1808). The autonomous response module can compare the threat riskparameter to the benchmark matrix to determine the autonomous response(Block 1810). The autonomous response module can determine an autonomousresponse based on the comparison (Block 1812).

The cyber threat defense system can generate a threat risk parameter todescribe the relative dangers of an anomalous event. FIG. 19 illustratesa block diagram of a threat risk parameter. The threat risk parametercan have a threat type describing the type of threat identified, such asfinancial, administrative, information technology, production, or other.The threat risk parameter can have a confidence score 1904 indicating abreach likelihood describing a probability that the template entity isin the breach state. The threat risk parameter can have a severity score1906 indicating a percentage that the template entity in the breachstate is deviating from normal behavior, as represented by the at leastone model. The threat risk parameter can have a user risk profile 1908,comprised of a user importance score and a vulnerability score,indicating a severity of damage attributable to the breach state.

FIG. 20 illustrates a flowchart of an embodiment of a method forgenerating a threat risk parameter. The cyber threat module can generatea threat risk parameter listing a set of values describing aspects ofthe breach state (Block 2002). The cyber threat module can identify athreat type for the cyber threat by using a variety of clusteringtechniques to group the threat with other identified cyber threats(Block 2004). The cyber threat module can generate a confidence score(Block 2006). The cyber threat module can generate a severity score(Block 2008). The cyber threat module can generate a degree of damagescore (Block 2010). The cyber threat module can populate the threat riskparameter with at least one of the confidence score, the severity score,and the consequence score (Block 2012).

FIG. 21 illustrates a block diagram of a benchmark matrix. Theautonomous response module, in conjunction with the cyber threat module,can populate the benchmark matrix with moving benchmarks that can adaptto the changing nature of both the network and threats to the network.The benchmark matrix can have a confidence benchmark 2102 indicating abreach likelihood describing a probability above which the templateentity is in the breach state. The benchmark matrix can have a severitybenchmark 2104 indicating a percentage above which the template entityis in the breach state. The benchmark matrix can have a consequencebenchmark 2106 indicating a severity of damage attributable to thebreach state that above which immediate action is to be taken. Theautonomous response module can adjust these benchmarks as more data isadded and greater user input is received.

The autonomous response module can assign a weight to each benchmarkscore to assign a relative importance to each benchmark score to factorin a decision to send an inoculation notice. As with the benchmarks,these weights may evolve over time. For example, the benchmark matrixcan have a confidence weight 2108 indicating the importance of theconfidence benchmark, a severity weight 2110 indicating the importanceof the severity benchmark, and a consequence weight 2112 indicating theimportance of the consequence benchmark. Using these assigned weights,different deviations from the benchmarks may have a greater result onthe final decision to send and inoculation notice.

FIG. 22 illustrates a flowchart of an embodiment of a method forgenerating a benchmark matrix. The autonomous response module cangenerate a benchmark matrix having a set of benchmark scores todetermine an autonomous response (Block 2202). The autonomous responsemodule can populate the benchmark scores in the benchmark matrix basedon data gathered during the breach identification process (Block 2204).The autonomous response module can assign a weight to each benchmarkscore to assign a relative importance to each benchmark score (Block2206).

FIG. 23 illustrates a flowchart of an embodiment of a method forcalculating a degree of damage score. The cyber threat defense systemcan assess the potential sphere of influence of the user based on atleast one of administrative permissions, lateral movement, actionpersistence, and file access (Block 2302). The cyber threat defensesystem can assign a user importance score to the user risk profile ofthe user based on the composite user profile to indicate a potentialsphere of influence of the user (Block 2304). The cyber threat defensesystem can generate a vulnerability score based on the third-party eventdata (Block 2306). The cyber threat defense system can factor the userimportance score and the vulnerability score into the user risk profileto calculate a degree of damage (Block 2308). The cyber threat defensesystem can calculate a degree of damage based on the user risk profile(Block 2310). The cyber threat defense system can adjust the normalbehavior benchmark based on the user risk profile (Block 2312).

FIG. 24 illustrates a flowchart of an embodiment of a method forexecuting an autonomous response. The cyber threat defense system canhave an autonomous response module configured to select a level ofautonomous response based on the relative danger of the anomalousmessage and the degree of reach of the user (Block 2402). The autonomousresponse module can limit access by the user to a suspect message (Block2404). The autonomous response module can delete a suspect message(Block 2406). The autonomous response module can revoke a permissionlevel for a user associated with a suspect message (Block 2408). Theautonomous response module can log out a user associated with a suspectmessage (Block 2410).

Cross Platform Coordination

The user specific profile module may develop a composite user profile toallow the cyber threat defense system to cross-reference data acrossmultiple platforms of the client system. FIG. 25 illustrates in a blockdiagram user context data collected from various platforms that may beused by the user specific profile module to develop a composite userprofile. The user context data can have username fields 2502 describingusernames assigned to the user by the instant messaging platform. Theuser context data can have display name fields 2504 that an instantmessaging platform uses to interact with the user. The user context datacan have a full name field 2506 for the legal name of the user stored inthe instant messaging platform. The user context data can have alanguage field 2508 describing the language setting for the instantmessaging platform. For example, the user context data may describe auser having a full name of Robert Smith, with a display name of Bob, anda username of Robert-Smith59, and a language setting of English.

The user context data can describe the position of the user within thecompany. The user context data can have group fields 2510 indicatingwhich work groups to which the user belongs. The user context data canhave a job title field 2512 listing a job title for the user stored inthe instant messaging platform. The user context data can have a rolesfield 2514 describing the role of the user in the client system. Forexample, Robert Smith can be a part of the software development groupwith a title of team lead and a role of a system administrator.

The user context field can describe the position of the user within thecompany. The user context data can have license information fields 2516describing the type of license that the user has with the variousplatforms and services. The user context data can have registereddevices fields 2518 describing the devices that the user has registeredfor use with the instant messaging platform. For example, Robert Smithcan have a license for Slack with a laptop and a smartphone listed asregistered devices.

The user context field can describe risk profiles for the user. The usercontext data can have click profile fields 2520 describing the tendencyof the user to click on suspicious links. The user context data can haveplatform risk assessment fields 2522 describing an assessment by thethird-party platform operator as to the dangers posed by the user. Forexample, Robert Smith can be considered likely to click on suspiciouslinks, and Microsoft Teams may consider him to be an extreme securityrisk.

FIG. 26 illustrates a flowchart of an embodiment of a method forgenerating a composite user profile. A context gatherer at the instantmessaging module can collect user context data to identify the user froman instant messaging platform (Block 2602). The context gatherer canharvest the user context data from the messaging archive (Block 2604).

The user specific profile module can match the user context data fromthe context gatherer with separate internal user context data from othercontext gatherers at internal service modules associated with otherapplications performed by the internal client system (Block 2606). Theuser specific profile module can match the user context data from thecontext gatherer with separate external user context data from othercontext gatherers at other probe modules associated with third-partyplatforms (Block 2608). The user specific profile module can apply afuzzy classifier to the user context data from the context gatherer tomatch with separate user context data (Block 2610).

The user specific profile module can generate a confidence score for amatch between the user context data from the context gatherer withseparate user context data from other context gatherers at otherapplication modules associated with other applications (Block 2612). Theinstant messaging module can match the user account sending an instantmessage to the registered user for the device sending the instantmessage (Block 2614). The user specific profile module can confirm auser identity based on a comparison of the device user to the useraccount (Block 2616).

Web Site

The web site is configured as a browser-based tool or direct cooperatingapp tool for configuring, analyzing, and communicating with the cyberthreat defense system.

Network

A number of electronic systems and devices can communicate with eachother in a network environment. FIG. 27 illustrates in a simplifieddiagram a networked environment. The network environment has acommunications network. The network can include one or more networksselected from an optical network, a cellular network, the Internet, aLocal Area Network (“LAN”), a Wide Area Network (“WAN”), a satellitenetwork, a 3^(rd) party ‘cloud’ environment, a fiber network, a cablenetwork, and combinations thereof. In some embodiments, thecommunications network is the Internet. There may be many servercomputing systems and many client computing systems connected to eachother via the communications network.

The communications network can connect one or more server computingsystems selected from at least a first server computing system and asecond server computing system to each other and to at least one or moreclient computing systems as well. The server computing systems can eachoptionally include organized data structures such as databases. Each ofthe one or more server computing systems can have one or more virtualserver computing systems, and multiple virtual server computing systemscan be implemented by design. Each of the one or more server computingsystems can have one or more firewalls and similar defenses to protectdata integrity.

At least one or more client computing systems for example, a mobilecomputing device (e.g., smartphone with an Android-based operatingsystem) can communicate with the server(s). The client computing systemcan include, for example, the software application or the hardware-basedsystem in which may be able exchange communications with the firstelectric personal transport vehicle, and/or the second electric personaltransport vehicle. Each of the one or more client computing systems canhave one or more firewalls and similar defenses to protect dataintegrity.

A cloud provider platform may include one or more of the servercomputing systems. A cloud provider can install and operate applicationsoftware in a cloud (e.g., the network such as the Internet) and cloudusers can access the application software from one or more of the clientcomputing systems. Generally, cloud users that have a cloud-based sitein the cloud cannot solely manage a cloud infrastructure or platformwhere the application software runs. Thus, the server computing systemsand organized data structures thereof can be shared resources, whereeach cloud user is given a certain amount of dedicated use of the sharedresources. Each cloud user's cloud-based site can be given a virtualamount of dedicated space and bandwidth in the cloud. Cloud applicationscan be different from other applications in their scalability, which canbe achieved by cloning tasks onto multiple virtual machines at run-timeto meet changing work demand. Load balancers distribute the work overthe set of virtual machines. This process is transparent to the clouduser, who sees only a single access point.

Cloud-based remote access can be coded to utilize a protocol, such asHypertext Transfer Protocol (“HTTP”), to engage in a request andresponse cycle with an application on a client computing system such asa web-browser application resident on the client computing system. Thecloud-based remote access can be accessed by a smartphone, a desktopcomputer, a tablet, or any other client computing systems, anytimeand/or anywhere. The cloud-based remote access is coded to engage in 1)the request and response cycle from all web browser-based applications,3) the request and response cycle from a dedicated on-line server, 4)the request and response cycle directly between a native applicationresident on a client device and the cloud-based remote access to anotherclient computing system, and 5) combinations of these.

In an embodiment, the server computing system can include a serverengine, a web page management component, a content management component,and a database management component. The server engine can perform basicprocessing and operating-system level tasks. The web page managementcomponent can handle creation and display or routing of web pages orscreens associated with receiving and providing digital content anddigital advertisements. Users (e.g., cloud users) can access one or moreof the server computing systems by means of a Uniform Resource Locator(“URL”) associated therewith. The content management component canhandle most of the functions in the embodiments described herein. Thedatabase management component can include storage and retrieval taskswith respect to the database, queries to the database, and storage ofdata.

In some embodiments, a server computing system can be configured todisplay information in a window, a web page, or the like. An applicationincluding any program modules, applications, services, processes, andother similar software executable when executed on, for example, theserver computing system, can cause the server computing system todisplay windows and user interface screens in a portion of a displayscreen space. With respect to a web page, for example, a user via abrowser on the client computing system can interact with the web page,and then supply input to the query/fields and/or service presented bythe user interface screens. The web page can be served by a web server,for example, the server computing system, on any Hypertext MarkupLanguage (“HTML”) or Wireless Access Protocol (“WAP”) enabled clientcomputing system (e.g., the client computing system 802B) or anyequivalent thereof. The client computing system can host a browserand/or a specific application to interact with the server computingsystem. Each application has a code scripted to perform the functionsthat the software component is coded to carry out such as presentingfields to take details of desired information. Algorithms, routines, andengines within, for example, the server computing system can take theinformation from the presenting fields and put that information into anappropriate storage medium such as a database (e.g., database). Acomparison wizard can be scripted to refer to a database and make use ofsuch data. The applications may be hosted on, for example, the servercomputing system and served to the specific application or browser of,for example, the client computing system. The applications then servewindows or pages that allow entry of details.

Computing Systems

A computing system can be, wholly or partially, part of one or more ofthe server or client computing devices in accordance with someembodiments. Components of the computing system can include, but are notlimited to, a processing unit having one or more processing cores, asystem memory, and a system bus that couples various system componentsincluding the system memory to the processing unit. The system bus maybe any of several types of bus structures selected from a memory bus ormemory controller, a peripheral bus, and a local bus using any of avariety of bus architectures.

The computing system typically includes a variety of computingmachine-readable media. Computing machine-readable media can be anyavailable media that can be accessed by computing system and includesboth volatile and nonvolatile media, and removable and non-removablemedia. By way of example, and not limitation, computing machine-readablemedia use includes storage of information, such as computer-readableinstructions, data structures, other executable software or other data.Computer-storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CD-ROM, digitalversatile disks (DVD) or other optical disk storage, magnetic cassettes,magnetic tape, magnetic disk storage or other magnetic storage devices,or any other tangible medium which can be used to store the desiredinformation, and which can be accessed by the computing device 900.Transitory media, such as wireless channels, are not included in themachine-readable media. Communication media typically embody computerreadable instructions, data structures, other executable software, orother transport mechanism and includes any information delivery media.

The system memory includes computer storage media in the form ofvolatile and/or nonvolatile memory such as read only memory (ROM) andrandom-access memory (RAM). A basic input/output system (BIOS)containing the basic routines that help to transfer information betweenelements within the computing system, such as during start-up, istypically stored in ROM. RAM typically contains data and/or softwarethat are immediately accessible to and/or presently being operated on bythe processing unit. By way of example, and not limitation, the RAM caninclude a portion of the operating system, application programs, otherexecutable software, and program data.

The drives and their associated computer storage media discussed above,provide storage of computer readable instructions, data structures,other executable software and other data for the computing system.

A user may enter commands and information into the computing systemthrough input devices such as a keyboard, touchscreen, or software orhardware input buttons, a microphone, a pointing device and/or scrollinginput component, such as a mouse, trackball or touch pad. The microphonecan cooperate with speech recognition software. These and other inputdevices are often connected to the processing unit through a user inputinterface that is coupled to the system bus but can be connected byother interface and bus structures, such as a parallel port, game port,or a universal serial bus (USB). A display monitor or other type ofdisplay screen device is also connected to the system bus via aninterface, such as a display interface. In addition to the monitor,computing devices may also include other peripheral output devices suchas speakers, a vibrator, lights, and other output devices, which may beconnected through an output peripheral interface.

The computing system can operate in a networked environment usinglogical connections to one or more remote computers/client devices, suchas a remote computing system. The logical connections can include apersonal area network (“PAN”) (e.g., Bluetooth®), a local area network(“LAN”) (e.g., Wi-Fi), and a wide area network (“WAN”) (e.g., cellularnetwork), but may also include other networks. Such networkingenvironments are commonplace in offices, enterprise-wide computernetworks, intranets and the Internet. A browser application or directapp corresponding with a cloud platform may be resident on the computingdevice and stored in the memory.

It should be noted that the present design can be carried out on asingle computing system and/or on a distributed system in whichdifferent portions of the present design are carried out on differentparts of the distributed computing system.

Note, an application described herein includes but is not limited tosoftware applications, mobile apps, and programs that are part of anoperating system application. Some portions of this description arepresented in terms of algorithms and symbolic representations ofoperations on data bits within a computer memory. These algorithmicdescriptions and representations are the means used by those skilled inthe data processing arts to most effectively convey the substance oftheir work to others skilled in the art. An algorithm is here, andgenerally, conceived to be a self-consistent sequence of steps leadingto a desired result. The steps are those requiring physicalmanipulations of physical quantities. Usually, though not necessarily,these quantities take the form of electrical or magnetic signals capableof being stored, transferred, combined, compared, and otherwisemanipulated. It has proven convenient at times, principally for reasonsof common usage, to refer to these signals as bits, values, elements,symbols, characters, terms, numbers, or the like. These algorithms canbe written in a number of different software programming languages suchas Python, C, C++, or other similar languages. Also, an algorithm can beimplemented with lines of code in software, configured logic gates insoftware, or a combination of both. In an embodiment, the logic consistsof electronic circuits that follow the rules of Boolean Logic, softwarethat contain patterns of instructions, or any combination of both.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussions, itis appreciated that throughout the description, discussions utilizingterms such as “processing” or “computing” or “calculating” or“determining” or “displaying” or the like, refer to the action andprocesses of a computer system, or similar electronic computing device,that manipulates and transforms data represented as physical(electronic) quantities within the computer system's registers andmemories into other data similarly represented as physical quantitieswithin the computer system memories or registers, or other suchinformation storage, transmission or display devices.

Many functions performed by electronic hardware components can beduplicated by software emulation. Thus, a software program written toaccomplish those same functions can emulate the functionality of thehardware components in input-output circuitry. Similarly, functionsperformed by two or more modules can be combined into a single module,where logically possible. Also, the functions performed by a singlemodule can be split into two or more distinct modules.

While the foregoing design and embodiments thereof have been provided inconsiderable detail, it is not the intention of the applicant(s) for thedesign and embodiments provided herein to be limiting. Additionaladaptations and/or modifications are possible, and, in broader aspects,these adaptations and/or modifications are also encompassed.Accordingly, departures may be made from the foregoing design andembodiments without departing from the scope afforded by the followingclaims, which scope is only limited by the claims when appropriatelyconstrued.

What is claimed is:
 1. A method for a cyber threat defense systemincorporating data across multiple platforms used by a client system toidentify cyber threats, comprising: collecting from one or more networkentities that utilize one or more instant messaging platforms, instantmessaging data describing an instant message and associated with a useraccount on at least a first instant messaging platform, where theinstant messaging data is collected into one or more instant messagemodules; identifying a user of the client system associated with theuser account based on a composite user profile constructed from usercontext data collected across multiple platforms of the client system inorder to contextualize the instant messaging data under analysis withdata from the multiple platforms of the client system, where thecomposite user profile for the multiple platforms of the client systemfactors in data from i) the instant messaging platform as well as ii) atleast one of a System-as-a-Service (SaaS) platform, a cloud platform, aninformation technology network, and an email platform, associated withthe user; associating the user with a user risk profile based on thecomposite user profile; applying one or more artificial intelligenceclassifiers to the instant message data based on the user risk profile;identifying whether the instant messaging data under analysiscorresponds to a cyber threat partially based on the user risk profile;and executing an autonomous response in cooperation with the instantmessaging platform to cause a response to the cyber threat using anautonomous response module itself rather than a human taking theresponse, that factors in the user risk profile.
 2. The method for thecyber threat defense system of claim 1, further comprising: gathering amessaging archive for the client system using a web hook for the instantmessaging platform.
 3. The method for the cyber threat defense system ofclaim 2, further comprising: accessing the messaging archive to collectthe instant messaging data for the user account.
 4. The method for thecyber threat defense system of claim 2, further comprising: providing aclient authorization to the web hook for the instant messaging platform.5. The method for the cyber threat defense system of claim 1, furthercomprising: polling an application programming interface of the instantmessaging platform for the instant messaging data associated with theuser account.
 6. The method for the cyber threat defense system of claim5, further comprising: translate the instant messaging data into auniversal format.
 7. The method for the cyber threat defense system ofclaim 1, further comprising: directing a mobile device managementsub-module in the instant message module to gather a messaging archivefrom the instant messaging platform.
 8. The method for the cyber threatdefense system of claim 1, wherein the autonomous response directed bythe autonomous response module is at least one of logging out the user,limiting access to a suspect message, deleting the suspect message, andrevoking a permission level for the user.
 9. A non-transitory computerreadable medium comprising computer readable code operable, whenexecuted by one or more processing apparatuses in the cyber threatdefense system to instruct a computing device to perform the method ofclaim
 1. 10. An apparatus for a cyber threat defense system, comprising:one or more instant messaging modules are configured to collect from oneor more network entities that utilize one or more instant messagingplatforms, instant messaging data describing an instant message andassociated with a user account on at least a first instant messagingplatform; a user specific profile module is configured to identify auser of a client system associated with the user account based on acomposite user profile constructed from user context data collectedacross multiple platforms of the client system, where the composite userprofile for the multiple platforms of the client system factors in datafrom the instant messaging platform as well as at least one of aSystem-as-a-Service (SaaS) platform, a cloud platform, an informationtechnology network, and an email platform associated with the user; arisk profile module is configured to associate the user with a user riskprofile based on the composite user profile; a comparison moduleconfigured to execute a comparison of the instant messaging data to atleast one machine-learning model trained on a normal benign behavior ofthat user using a normal behavior benchmark describing parameterscorresponding to a normal pattern of activity for that user to spotbehavior on the client system deviating from the normal benign behaviorto identify whether the user is in a breach state of the normal behaviorbenchmark; a cyber threat module is configured to identify whether theinstant messaging data under analysis corresponds to a cyber threatpartially based on the user risk profile; and an autonomous responsemodule is configured to execute an autonomous response in response tothe cyber threat factoring in the user risk profile.
 11. The apparatusfor the cyber threat defense system of claim 10, wherein the instantmessaging module is further configured to harvest from the instantmessaging data at least one of participants, text content, attachments,hyperlinks, and apps.
 12. The apparatus for the cyber threat defensesystem of claim 10, wherein the risk profile module is furtherconfigured to apply one or more artificial intelligence classifiers tothe instant message based on the user risk profile.
 13. The apparatusfor the cyber threat defense system of claim 12, wherein the artificialintelligence classifier is trained to perform a function of at least oneof a personal name classifier, a password classifier, an account loginactivity classifier, a time series classifier, a bad link analysisclassifier, an attachment classifier, natural language processing, asentiment analysis, a keyword trend analysis classifier, a complianceclassifier, and a general normality classifier.
 14. The apparatus forthe cyber threat defense system of claim 10, wherein the risk profilemodule is further configured to execute a sentiment analysis of textcontent of a first instant message to determine a tone of the textcontent.
 15. The apparatus for the cyber threat defense system of claim10, wherein the risk profile module is further configured to execute akeyword trend analysis of the instant message to look for words ofinterest.
 16. The apparatus for the cyber threat defense system of claim10, wherein the risk profile module is further configured to assesscompliance of the instant message with client system protocolsdescribing a policy set instated by the client system.
 17. The apparatusfor the cyber threat defense system of claim 10, further comprising: auser interface module configured to represent the instant message as atleast one of text data and a data point in a time series graph in agraphical user interface.
 18. The apparatus for the cyber threat defensesystem of claim 10, wherein the autonomous response directed by theautonomous response module is at least one of logging out the user,limiting access to a suspect message, deleting a suspect message, andrevoking a permission level for the user.
 19. An apparatus, comprising:a cyber security system having an instant messaging module configured toi) analyze content contained within one or more instant messages,including at least text within the instant messages, in an instantmessaging platform, where a cyber threat module is configured tocooperate with the instant messaging module to analyze for any potentialmalicious behavior deviating from a first user's normal behaviorcompared against an artificial intelligence model trained on maintaininga pattern of life of, at least, the first user in the instant messagingsystem, where the comparison can indicate a possible cyber threat hascompromised the instant messaging platform; where the instant messagingmodule is also configured to analyze content contained within the one ormore instant messages including at least the text within the instantmessages for compliance violations by the one or more instant messagescompared to policy set for a client system that uses the instantmessaging platform; and a user interface module to cooperate with thecyber threat module to communicate a first compliance violation and/or afirst potential cyber threat.
 20. The apparatus of claim 19, furthercomprising: an autonomous response module configured to cooperate withan application programming interface of the instant messaging platformto take an autonomous action itself, rather than a human taking theaction, to mitigate against the first compliance violation and/or thefirst potential cyber threat.